search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
940 stars 218 forks source link

Some deleted chats or messages not being tagged as deleted #1843

Closed hauck-jvsh closed 1 year ago

hauck-jvsh commented 1 year ago

Our coligue here, João Paulo, found a case with several deleted messages. These messages are recovered and marked as delete on the Physical Analyzer, but on IPED they are shown without the deleted mark. This occurs in version 4.1.1 with an IOS device. He is processing again using version 4.1.4 to see if it is happening in the last version.

lfcnassif commented 1 year ago

Has he used the internal or external parser? If the internal one, maybe those messages exist and are not deleted. IPED is able to recover deleted WA messages from iOS, but it discards corrupted or duplicated messages. PA recovers many duplicated messages and doesn't discard them...

If he used the external parser, maybe some regression was introduced recently (bug) or maybe the report.xml schema in the UFDR has changed recently (not a bug but lack of support for recent UFDR versions).

hauck-jvsh commented 1 year ago

He was using the internal parser, I think that the messages are really deleted, but I will confirm later, because he goes to that chat after seeing a message in the log saying that the group is deleted. In physical analyzer it appears as two chats one delete with the messages and another one not deleted but without any messages.

lfcnassif commented 1 year ago

Cool! So the tool could have recovered a deleted group, that is great. Of course we should tag it as such, if it really is.

lfcnassif commented 1 year ago

he goes to that chat after seeing a message in the log saying that the group is deleted

IPED log, Whatsapp log or PA log?

hauck-jvsh commented 1 year ago

WhatsApp log, I'm in the Interforensics event this week, because of that I will look at this only in the next week.

lfcnassif commented 1 year ago

Don't worry, take your time and enjoy the conference!

hauck-jvsh commented 1 year ago

I was looking at this today, and it seems like that there is a flag in the chat database ZREMOVED that is 1 when the chat is deleted. The chat is not really deleted, I don't know if it is marked and deleted later, or if it will remain marked forever.

lfcnassif commented 1 year ago

Thanks for looking into this! If user can't see the chat in the phone screen, I think we can flag it as deleted.

hauck-jvsh commented 1 year ago

https://reunir.unir.net/bitstream/handle/123456789/2832/Memoria_TFM.pdf This document has some information about forensics in IOS devices. It says that zremoved is from when a chat is delete and maybe there is another interesting information, the zwachatsession.zhidden. this shows if the chat is hidden or not.

lfcnassif commented 1 year ago

Thanks @hauck-jvsh! I just wondered if the Android parser code is reading a similar column to ZREMOVED... Could you check?

hauck-jvsh commented 1 year ago

Maybe there is something similar, I can take a look at this.

hauck-jvsh commented 1 year ago

I found the hidden flag and a archived flag, but I'm not sure what the archived flag means. One thing that I notice, there is a table deleted_chat_job, but I don't know what it means.

lfcnassif commented 1 year ago

If you tap and hold your finger on a conversation in the conversation list, WhatsApp will show some options on the top, one of them is to archive the chat. On my turn, I didn't know about hidden chats, just found the option to enable it in the contact screen.