Investigating Window Viber
17/03/2023 Friday
Viber is a popular messaging app that allows users to make calls, send texts, photos, videos, and share other types of files. It is available for download on Windows, iOS, Mac, and Android devices and it is used by millions of people worldwide. in this blog we will discuss more details folowing on the previous blog
Digital Forensics Value of Viber
Viber can be a valuable source of information during a forensic analysis as Viber artifacts retain information related to calls, contacts, chats, messages, and application configuration.
Location of Viber Artifacts
Viber artifacts are found in the following location:
% %systempartititon%Users\%username%\AppData\Roaming\ViberPC\%user’s phone number %\
Analyzing Viber with ArtiFast
This section will discuss how to use ArtiFast to extract Viber from Windows and what kind of digital forensics insights we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Viber artifacts.
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Window Viber artifacts in ArtiFast.
Viber Calls Artifact
- Date - The date and time when the call was sent or received.
- Caller - The caller number.
- Call Status - Indicates call status (answered or missed).
- Call Type - Indicates call type (voice call or video call).
- Is Seen - Indicates whether the call is seen or not.
- Duration - The duration of the call.
- Receiver - Call receiver number.
Viber Contacts Artifact
- User Name - The name as saved on the phone.
- Viber User Name - The name chosen by the user as their name on Viber.
- Phone Number - The user’s phone number
- Has Viber Account - Indicates weather user has a Viber account or not.
- User Date of Birth - The user date of birth.
- Is this Account user - True when the row contains the main user’s information them self’s.
Viber Chats Artifact
- Date - Last message date and time.
- Sticker ID - The sticker ID.
- Payload Path - Chat payload path.
- Receiver - Chat receiver number.
- Is Read - Indicates whether the chat is read or not.
- Sender - Chat sender number.
- Message Type - Chat type.
- Message Body - Chat body.
- Direction - Indicates chat direction (outgoing/ingoing).
Viber Settings Artifact
- Backgrounds Folder - Application backgrounds folder.
- Default Phone Prefix - Default phone prefix.
- Is Download Photo and Video - Indicates whether media downloading is enabled.
- Is Incoming Calls - Indicates whether incoming calls are enabled.
- Avatar Folder - Avatar folder path.
- Is Messages - Indicates whether messages are enabled.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
