Investigating Window Unigram
03/03/2023 Friday
Unigram is a free and open-source messaging app for Windows devices that provides a fast, reliable, and secure messaging experience for Telegram users. With end-to-end encryption and no data collection, Unigram prioritizes user privacy and security. Users can send messages, voice notes, photos, and videos, create and join groups and channels, and customize notifications and themes. Overall, Unigram is a powerful and user-friendly app that offers a native interface for accessing Telegram's features on Windows.
Digital Forensics Value of Unigram
Unigram Windows as a messaging app is becoming increasingly popular among users who value their privacy and security. As a result, it has become an important platform for digital forensics investigators who are looking to recover evidence from a suspect's device. One of the main challenges in investigating Unigram is the end-to-end encryption used by the application, which makes it difficult to access user data. However, investigators can still extract valuable information from the Application since it keeps record of files containing user activity related information. This information can include important timestamps, file contents, and more.
Location of Unigram Artifacts
Unigram artifacts are found in the following location:
%systempartititon%\Users\%username%\AppData\Local\Packages\38833FF26BA1D.UnigramPreview_g9c9v27vpyspw\LocalState\0
Analyzing Unigram with ArtiFast
This section will discuss how to use ArtiFast to extract Unigram from Windows and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Unigram artifacts.
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Window Unigram artifacts in ArtiFast.
Unigram Animations Artifact
- Date - last access date/time.
- Animation File Name - The animation file name.
- Animation File Path - The animation file location.
- Animation File Extension - The animation file extension.
- Animation File (base64) - The animation file stored as base64.
Unigram Documents Artifact
- Date - last access date/time.
- Document Name - The document name.
- Document Extension - The document extension.
Unigram Photos Artifact
- Date - last access date/time.
- ID - The photo ID.
- Extension - The photo extension.
- Photo (base64) - The photo stored as base64.
Unigram Stickers Artifact
- Date - last access date/time.
- ID - The sticker ID.
- Extension - The sticker extension.
- Sticker (base64) - The sticker stored as base64.
Unigram Profile Photos Artifact
- Date - last access date/time.
- ID - The photo ID.
- Extension - The photo extension.
- Photo (base64) - The photo stored as base64.
Unigram Thumbnails Artifact
- Date - last access date/time.
- Thumbnail File Name - The Thumbnail file name.
- Thumbnail File Path - The Thumbnail file location.
- Thumbnail File Extension - The Thumbnail file extension.
- Thumbnail File (base64) - The Thumbnail file stored as base64.
Unigram Videos Artifact
- Date - last access date/time.
- Video Path - The video file location.
- Extension - The video extension.
- Video Name - The video name.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
