±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35535
New Yesterday: 0 Visitors: 103

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

WhatsApp folder structure UFED Extraction iOS

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

jjcardiff
Newbie
 

WhatsApp folder structure UFED Extraction iOS

Post Posted: Apr 04, 19 11:20

I have extracted WhatsApp conversation images from an iPhone 7 Plus running iOS 12.1.4.

Displayed in Cellebrite UFED Analyzer the folder structure for the devices's Images are as follows

Joe Blogs iPhone
Applications
group.net.whatsapp.WhatsApp.shared
Messages/Media
*contactnumber*@s.whatsapp.net (13 items)
c/8 (2 items)
d/c (2 items)
7/8 (2 items)
8/c (2 items)
6 (3 items)
0/7 (1 item)

When I come to create a report I notice that every image is duplicated due to it having a .thumb copy, however this .thumb duplicate is not contained within the same file as the original image or all of the other .thumb photos.

Does anyone know:
1. What all of the above various folders mean within the overall contact number folder
2. How or why images are put into these titled folders (I can't see any obvious reasoning from the metadata)
3. A quick way to not report all .thumb files

Many thanks in advance  
 

Page 1 of 1