Investigating Cisco Webex Meetings
06/08/2022 Saturday
Cisco Webex Meetings is an online meeting/conference application that allows users to virtually meet with others. Participants can connect a Webex meeting using HD video and audio across web, desktop, mobile or video systems. It supports video conferencing features like screen sharing, file sharing, meeting recording, and more.
Digital Forensics Value of Cisco Webex Meetings Artifacts
Cisco Webex Meetings contains information about the users participated in a meeting, files shared during a meeting and chat history about the user of the computer. Investigating Cisco Webex Meetings' artifacts can provide useful information during a forensics investigation.
Location and Structure of Cisco Webex Meetings Artifacts
Artifacts related to Cisco Webex Meetings are located at:
"C:\Users\%Username%\AppData\Local\WebEx\"
Cisco Webex Meetings artifacts are stored in user's AppData\Local folder by default. File transfers are stored in Documents folder with the following file name format: %Meeting Host name%Personal Room.
Analyzing Cisco Webex Meetings Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to extract Cisco Webex Meetings artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Cisco Webex Meetings artifacts using Grid View by choosing the related icon:
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via "Artifact View" or "Timeline View," with indexing, filtering, and searching capabilities. Below is a detailed description of the Cisco Webex Meetings artifacts in ArtiFast.
Cisco WebEx Meetings Client Information: This artifact contains information about Cisco Client.
- Working Folder - Local location of the meeting folder.
- Client Build Version - Client WebEx Application version.
- GpcPhpHashSame as the ClientBuildVersion.
- FileList - It is the location of the gpc.json file.
- Last Meeting Activity - Last Meeting's Timestamp.
Cisco WebEx Meetings Site Information: This artifact contains information about Cisco Site.
- Meeting Host's URL - It represents the URL of the meeting host.
- Client Build Version - Client WebEx Application version.
- Working Folder - Location of where the meeting data would be stored.
- Language - The Client's Language.
- Last Meeting Activity - The Last Meeting Timestamp.
Cisco WebEx Meetings History Information: This artifact contains information about Cisco Webex Meetings' history.
- Meeting History URL - URL of the meeting.
- Date - The date of the meeting.
Cisco WebEx Meetings Jmt Cache Information: This artifact contains information about Cisco Webex Meetings' Jmt Cache.
- Correlation ID - Correlation ID of the meeting.
- Send Count - Send Count
- Timestamp - Timestamp of the meeting.
Cisco WebEx Meetings Pre-Download Information: This artifact contains information about Cisco Pre-Download information about the meeting.
- Jmt Log File Name - Log File Name
- Backup URL Root - Backup URL
- Call Event Log URL - Call analyzer’s event log URL.
- Client Build Version - Client Build version of the meeting host, stored in Base64.
- Gpc Site Domain - Site Domain
- Jme Ini Path - Path for preDownload file.
- Local Client Build Version - Client build version of the local application.
- Meeting Random - Meeting random number stored in Base64, for instance 660934625.
Cisco WebEx Meetings Latest Joined Location Information: This artifact contains information about Cisco Latest Joined Location.
- Location - Latest Location.
- Date - Latest Location Date.
Cisco WebEx Meetings User Information: This artifact contains information about Cisco user.
- Email Address - Email Address
- Site URL - Site URL
For more information or suggestions please contact: ummulkulthum.wambai@forensafe.com
