WhatsApp Data Extra...
 
Notifications
Clear all

WhatsApp Data Extraction

11 Posts
10 Users
0 Likes
4,121 Views
(@rohitdharan)
Posts: 17
Active Member
Topic starter
 

Hello Experts.
Hope you all are doing well.

My question is how to extract WhatsApp data with the help of UFED?

 
Posted : 21/06/2019 10:36 am
OxygenForensics
(@oxygenforensics)
Posts: 143
Estimable Member
 

Since nobody has answered your question we would like to say some words about our WhatsApp methods.
Oxygen Forensic Detctive offers complete WhatsApp acquiistion from Apple and Android devices, extraction of WhatsApp backups from iCloud and Google Drive and several exclusive methods - access to the WhatsApp server, WhatsApp backup decryption via phone number and WhatsApp extraction via QR token from PC. If you are interested you can drop us an email to request a demo license.

 
Posted : 27/06/2019 1:13 pm
(@rohitdharan)
Posts: 17
Active Member
Topic starter
 

Since nobody has answered your question we would like to say some words about our WhatsApp methods.
Oxygen Forensic Detctive offers complete WhatsApp acquiistion from Apple and Android devices, extraction of WhatsApp backups from iCloud and Google Drive and several exclusive methods - access to the WhatsApp server, WhatsApp backup decryption via phone number and WhatsApp extraction via QR token from PC. If you are interested you can drop us an email to request a demo license.

Thank you so much !

 
Posted : 28/06/2019 9:46 am
Styers
(@styers)
Posts: 27
Eminent Member
 

Cloud analyzer if they have the password saved, and if the have it set up to save cloud backups.

A lot of "ifs" in that method. But it has worked for me a few times.

 
Posted : 28/06/2019 6:00 pm
(@matrix4n6)
Posts: 6
Active Member
 

To extract WhatsApp-Data in UFED you have to use the option "Android Backup APK Downgrade" (to be found under the "File System" category).
(I don't know if that option is available in all UFED license models.)

 
Posted : 01/07/2019 12:48 pm
(@cs1337)
Posts: 83
Trusted Member
 

I have been having alot of success with the APK downgrade method in cellebrite UFED 4 PC. Make sure to install the APK Downgrade pack from the portal and install it into UFED 4 PC. one thing to keep in mind it is recommended by Cellebrite support as a "last resort" after jTag or chip-off as it is altering the APP version on the phone in order to extract the data.

 
Posted : 02/07/2019 6:02 pm
(@obev0098)
Posts: 3
New Member
 

Was you able to recover deleted data on an IOS device using UFED? We have only had luck on Android devices which we no longer supply.

 
Posted : 06/08/2019 6:28 pm
(@hunter)
Posts: 32
Eminent Member
 

https://paraben-sticks.com/chat-stick.html

Cheap solution. IDK if it supports whatsapp

 
Posted : 12/08/2019 8:13 pm
(@skswati)
Posts: 5
Active Member
 

To extract WhatsApp-Data in UFED you have to use the option "Android Backup APK Downgrade" (to be found under the "File System" category).
(I don't know if that option is available in all UFED license models.)

When you try this method it warms that use this as last method and in next window it also notify that user credentials might be lost, than how could we try this?

 
Posted : 05/09/2019 4:57 pm
(@denyzkoo)
Posts: 2
New Member
 

If you have physical exctraction UFED parse whatsapp as well. From advanced logical or filesystem you can get msgstore.db.crypt12 database file but keys to decrypt it are hidden. You need to get root eq get physical extraction to get keys to msgstore.db.crypt12. Its tricky, cuz get root permision of new androids is big problem.

 
Posted : 07/09/2019 6:47 am
Page 1 / 2
Share: