Investigating Android Wire Messenger
18/07/2025 Friday
Android Wire is a private messaging app developed by Wire Swiss for
Android devices. It allows users to communicate through text messages,
voice and video calls, and to share files. Moreover, this app—similar to
its alternatives—offers features like group chats, conference calls, and
synchronization across multiple devices. Wire also prioritizes user
privacy by providing options such as self-destructing messages and guest
access.
Digital Forensics Values of Android Wire Messenger
Due to its reputation as a secure messaging platform, data extracted
from Wire may provide important potential evidence for digital forensic
examiners. This data may include information about users’ identities,
contact lists, timestamps, shared media, call logs, and the content of
conversations. Such information can help forensic examiners reconstruct
communication patterns, identify key individuals involved in an
investigation, and establish timelines of events.
Location of Android Wire Messenger
Android Wire Messenger artifact can be found at the following
locations:
*/com.wire/databases/<user_ID>
Analyzing Android Wire Messenger Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android Wire
Messenger artifacts from Android machines’ files and what kind of
digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select Android
Wire Messenger artifact parser:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android Wire Messenger artifacts in ArtiFast.
Android Wire Messenger User Profile
- Registration Date/Time: The user registration date/time.
- User ID: The user unique identifier.
- Phone Number: The user phone number.
- Display Name: This user display name.
- Email Address: The email addresses registered by this account holder.
- Device Model: The model of this device.
- Verification Status: The verification status of this account.
- Verification Device: The device used in the verification process.
- Profile Picture File Name: The file name of this user profile picture.
Android Wire Messenger Users
- Connection Date/Time: The user registration date/time.
- User ID: The user unique identifier.
- Handle: This user handle.
- Phone Number: The user phone number.
- Display Name: This user display name.
- Email Address: The email addresses registered by this account holder.
- Profile Picture ID: The ID of this user profile picture.
Android Wire Messenger Text Messages
- Message Sent Date/Time: Message sending date.
- Content: The body of the message.
- Sender Name: Name of the sender.
- Conversation ID: The conversation ID that the message belongs to.
- Message ID: ID of the message.
- Message Direction: Indicates whether this is an outgoing or incoming message.
Android Wire Messenger Calls
- Conversation ID: The conversation ID that the message belongs to.
- Call Date/Time: The date/time when this call has been made.
- Type: The type of this call.
- Call ID: The call unique identifier.
- Call Direction: The direction of this call.
- Sender Name: Sender.
- Call Duration: The call duration in seconds.
Android Wire Messenger Locations
- Latitude: Sent location latitude.
- Longitude: Sent location longitude.
- Message Sent Date/Time: Message sending date.
- Sender Name: Name of the sender.
- Conversation ID: The conversation ID that the message belongs to.
- Message ID: ID of the message.
- Message Direction: Indicates whether this is an outgoing or incoming message.
- Location Title: The text description of this location.
Android Wire Messenger Images
- Image Path: Path to the image file.
- Message Sent Date/Time: Message sending date.
- Sender Name: Name of the sender.
- Conversation ID: The conversation ID that the message belongs to.
- Message ID: ID of the message.
- Message Direction: Indicates whether this is an outgoing or incoming message.
- MIME Type: The type of the data stored in this file.
- Image ID: ID of the image.
- Size: The size of the image in bytes.
Android Wire Messenger Conversations
- Last Event Date/Time: Date and time when the last event has been made on this conversation.
- Conversation ID: This chat conversation ID.
- Conversation Title: The title of this conversation.
- Creator Name: The name of the creator of this conversation.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
