Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Learning Android Forensics
  • Toc
  • feedback
Learning Android Forensics

Learning Android Forensics

4.2 (6)
close
Learning Android Forensics

Learning Android Forensics

4.2 (6)

Overview of this book

If you are a forensic analyst or an information security professional wanting to develop your knowledge of Android forensics, then this is the book for you. Some basic knowledge of the Android mobile platform is expected.
Table of Contents (10 chapters)
close
9
Index

WhatsApp analysis


WhatsApp is a popular chat-/video-messaging service with over 500,000,000 downloads in Google Play.

Package name: com.whatsapp

Version: 2.11.498

Files of interest:

  • /files/

    • Avatars/

    • me

    • me.jpeg

  • /shared_prefs/

    • RegisterPhone.xml

    • VerifySMS.xml

  • /databases/

    • msgstore.db

    • wa.db

  • /sdcard/WhatsApp/

    • Media/

    • Databases/

The /files/avatars directory contains thumbnails of the profile pictures of contacts that use the app, and me.jpg is a full-size version of the user's profile picture. The me file contains the phone number associated with the account

The phone number associated with the account can also be recovered in /shared_prefs/RegisterPhone.xml. The /shared_prefs/VerifySMS.xml file shows the time that the account was verified (in the Linux epoch format, of course), indicating when the user first began using the app.

The msgstore.db database, like it sounds, contains messaging data:

Table

Description

chat_list

The key_remote_jid column shows each account the user has communicated...

bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete