Investigating WhatsApp
18/06/2021 Friday
WhatsApp is a cross-platform application owned by Facebook. The platform supports sending and receiving text and voice messages, photos, documents, videos, and locations. WhatsApp provides all these features along with voice and video calls for one-to-one chats and group chats.
Digital Forensics Value of WhatsApp Artifacts
Since its early beginnings and till today, WhatsApp remains the market leader and one of the top-ranking messaging applications globally. According to its official website, WhatsApp has more than 2 billion users in over 180 countries. Given its widespread popularity, WhatsApp is considered a significant source of evidentiary information in most investigations.
Location of WhatsApp Artifacts
Like many Windows applications, WhatsApp stores user generated files at C:\Users\%username%\AppData\Roaming\WhatsAppC:\Users\%username%\AppData\Roaming\WhatsApp
Structure of WhatsApp Artifacts
The majority of WhatsApp artifacts are maintained within the cache folder which has the same storage structure as Google Chrome Cache; however, the structure of the file containing WhatsApp cookies is SQLite database.
Analyzing WhatsApp Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to analyze WhatsApp artifacts from Windows machines and what kind of digital forensic insights we can gain from the platform.
After you have created your case and added evidence for the investigation, at the Artifact Parser Selection Phase, you can select WhatsApp Artifacts:
ArtiFast can analyze WhatsApp Cache, Profile Pictures, and Cookies. For demonstration purposes, all three artifacts have been chosen; however, you have the option to select one or more artifacts as well.
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via "Artifact View" or "Timeline View," with indexing, filtering, and searching capabilities. Below is a detailed description of WhatsApp artifacts in ArtiFast software.
WhatsApp Profile Pictures Artifact
This artifact contains information related to the profile pictures cached by the application. Profile pictures are not cached randomly from all WhatsApp contacts; instead, the cache only stores the profile pictures presented in the current chat section (active chats). This applies to both groups and individual chats. If a chat is deleted or archived, WhatsApp will not cache the profile picture of that specific chat. Moreover, if a chat (group/individual) does not have a profile picture, then there will not be any indication of that chat in the cache (default profile pictures are not cached). The details you can view include:
- Last Accessed Date/Time - The last accessed date/time of the cached image.
- URL - The URL of the profile picture.
- Size - The size of the image in bytes.
- Image Payload - The Image payload file location.
- Is Viewed - Indicates whether the image was viewed by the user.
- Chat Type - The type of the chat from which the image was cached (Individual/Group).
- Phone Number - The contact's phone number (or the group creator phone number, if it was a group chat).
WhatsApp Cache Artifact
This artifact contains information about WhatsApp Cache. The details you can view include:
- HTTP Content - The HTTP header content.
- Is Dirty - Indicates whether this entry is dirty.
- Key - The Key or URL of the cached file.
- Long Key Data - The cache entry long key data.
- Payload - The cache payload.
- Refetch Count - The cache entry fetch count.
- Reuse Count - The cache entry reuse count.
- State - State.
- Creation Time - The date/time when the cached entry was created.
- Cache Entry Last Modified Time - The date/time when the cached entry was last modified.
- Cache Entry Last Used Time - The date/time when the cached entry was last fetched.
WhatsApp Cookies Artifact
This artifact contains the Cookies from WhatsApp application on a Windows device. The details you can view include:
- Name - The name of the cookie.
- Value - The value of the cookie.
- Host - The host domain of the cookie.
- Path - The path to the cookie.
- Is Secure - Indicates whether the connection is secure or not.
- Is Http Only - Indicates whether it supports HttpOnly or not.
- Creation Date - The date/time when the cookie was created.
- Expiration Date - The date/time when the cookie will expire (If the cookie was set to expire).
- Last Access Date - The date/time when the cookie was last accessed.
