WhatsApp folder str...
 
Notifications
Clear all

WhatsApp folder structure UFED Extraction iOS

1 Posts
1 Users
0 Likes
983 Views
socratescymru
(@socratescymru)
Posts: 13
Eminent Member
Topic starter
 

I have extracted WhatsApp conversation images from an iPhone 7 Plus running iOS 12.1.4.

Displayed in Cellebrite UFED Analyzer the folder structure for the devices's Images are as follows

Joe Blogs iPhone
Applications
group.net.whatsapp.WhatsApp.shared
Messages/Media
*contactnumber*@s.whatsapp.net (13 items)
c/8 (2 items)
d/c (2 items)
7/8 (2 items)
8/c (2 items)
6 (3 items)
0/7 (1 item)

When I come to create a report I notice that every image is duplicated due to it having a .thumb copy, however this .thumb duplicate is not contained within the same file as the original image or all of the other .thumb photos.

Does anyone know
1. What all of the above various folders mean within the overall contact number folder
2. How or why images are put into these titled folders (I can't see any obvious reasoning from the metadata)
3. A quick way to not report all .thumb files

Many thanks in advance

 
Posted : 04/04/2019 11:20 am
Share: