This table includes the following and more: Unlike Kik or BBM, where a user is required to have a unique username or PIN, WhatsApp uses the user’s phone number as a unique identifier for both the user and their contacts. The messages table contains a listing of all the messages that a user sends or receives from his/her contacts. The msgstore.db is a relatively simple SQLite database with two tables: chat_list and messages. The msgstore.db contains details on any chat conversations between a user and their contacts, whereas the wa.db stores information on all the WhatsApp user’s contacts. IOS – /root/var/mobile/Applications//Documents/ChatStorage.sqliteĪndroid – /data/data/com.whatsapp/databases/msgstore.dbĪndroid – /data/data/com.whatsapp/databases/wa.dbĪndroid – /sdcard/WhatsApp/Databases/msgstore.db.crypt*įor Android devices, there are two SQLite databases of value for examiners recovering WhatsApp artifacts: msgstore.db and wa.db. RELATED ARTIFACTS: WhatsApp Contacts, WhatsApp Messages
0 Comments
Leave a Reply. |