Null HYD APR 2015

1. About Me

2. I am Not A....
●
Teacher
●
Trainer
●
Hacker
●
.........I am An IT Security Analyst ........

3. Todays Entertainment
WhatsApp
Forensic

4. Introduction

5. Steps to Perform Forensic

6. Key Artifiacts of WhatsApp
●
Main Evidence files-->>
●
->/data/data/com.whatsapp/databases/msgstore.db
●
->/data/data/com.whatsapp/databases/wa.db
●
->/sdcard/WhatsApp/Databases/msgstore.db.crypt8

7. Directory Structure
●
Main Evidence Directories-->>
●
.Shared - Hidden
●
.Trash - Hidden
●
Databases
●
Media
●
Profile Pictures

8. Ricovery Methods
●
1. Online Websites
●
Example:- https://www.recovermessages.com/
2. Get back Deleted WhatsApp Messages Manually
●
3. Tools
●
Example:- Oxygen Forensic Suite, Mobiledit Etc

9. Comman Challenges
●
1. Encryption
●
2. Tools are Paid
●
3. Patience and Time Consuming

10. Demo...

11. References
->http://sch3m4.github.io/wforensic/
->http://www.magnetforensics.com/recovering-whatsapp-forensic-artifacts/
->http://blog.digital-forensics.it/2012/05/whatsapp-forensics.html

12. Credits -->> Internet & Me

13. Any Queries..??
----------->>Thank You<<-----------