Read and summarize the reading “Forensic analysis of WhatsApp Messenger on Android
smartphones” (posted with this assignment). Do not skip the technical/hands-on parts and
discussions. Make sure your summary is mostly with your own words.
The “WhatsApp” reading describes the forensic analysis of artifacts left on Android
devices by WhatsApp Messenger, the client of the WhatsApp instant messaging system, a
complete description of all the artifacts generated by the app, decoding and interpretation
of each of the them, and finally, the correlation of the artifacts in order to infer various
types of information that cannot be obtained when looked at individually.
To access the artifacts, the researchers used software-emulated Android devices: the
YouWave virtualization platform was used, due to the ability to completely imitate the
behavior of an Android device. The experimental test-bed included a set of YouWave
virtual machines running Android v.4.0.4., with installed WhatsApp Messenger v.2.11.
Once the experiment was completed, the files using the corresponding internal memory
were parsed using FTK Imager v.3.1, and the files that stored the data generated by
WhatApp Messenger was extracted. The tools used to examine the files included
SqliteMan, which allowed for the examination of the databases on WhatsApp Messenger.
When the forensic investigation began, the investigators found the WhatsApp artifacts
stored into a set of files (Table 1).
The artifacts in Table 1 were analyzed and associations were made in order to deduce
several pieces of information, such as analyses of contact information, exchanged
messages, application settings and user preferences.
ANALYSIS OF CONTACT INFORMATION
This involves retrieving information stored in the contacts database, followed by an
analysis of the information to determine the list of contacts, when a contact has been added
to the database, whether a contact has been blocked, and when, and how deleted contacts
are handled.
Retrieval of contact information revealed the following tables:
1. “wa_contacts” (stores record for contacts)
2. “android_metadata”
3. “sqlite_sequence” (both store housekeeping information on “wa.db” (contacts database).
Structure of records in “wa_contacts” is shown in Table 2.
Determining when a contact has been added requires the analysis of the log files generated
by WhatsApp Messenger.
WhatsApp logs events when a contact is added to the “wa.db” database. Examples of these
events are shown in Figure 1:
Investigating blocked contacts requires analyzing log files as well. Figure 2 shows a
contact being blocked with the WhatsApp ID of the contact and the time of the block:
Looking at deleted contacts, and possibly recovering deleted records involved the use of
the Oxygen Forensic SQLite Viewer. In the experiment, it was possible to recover deleted
