I have extracted WhatsApp conversation images from an iPhone 7 Plus running iOS 12.1.4.
Displayed in Cellebrite UFED Analyzer the folder structure for the devices's Images are as follows
Joe Blogs iPhone
Applications
group.net.whatsapp.WhatsApp.shared
Messages/Media
*contactnumber*@s.whatsapp.net (13 items)
c/8 (2 items)
d/c (2 items)
7/8 (2 items)
8/c (2 items)
6 (3 items)
0/7 (1 item)
When I come to create a report I notice that every image is duplicated due to it having a .thumb copy, however this .thumb duplicate is not contained within the same file as the original image or all of the other .thumb photos.
Does anyone know
1. What all of the above various folders mean within the overall contact number folder
2. How or why images are put into these titled folders (I can't see any obvious reasoning from the metadata)
3. A quick way to not report all .thumb files
Many thanks in advance