search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
886 stars 211 forks source link

Unify WhatApp Chats? #2075

Closed filipesimoes closed 3 months ago

filipesimoes commented 5 months ago

When a user changes the phone number in WhatsApp and keeps chating with the same contact, UFED Reader shows this as the same chat session and shows this information on the chat properties as multiple "owners". On the other hand, IPED shows this as different chats, one for each different number.

Is this by design or is a missing feature?

wladimirleite commented 5 months ago

Do both chats (from before and after the number change) come from the same database? Can you privately share a database with this situation?

lfcnassif commented 5 months ago

I believe it's a missing feature. @filipesimoes, if you can share a database which reproduces the situation, with me or @wladimirleite by Teams, it would help a lot to check.

wladimirleite commented 5 months ago

@filipesimoes sent me 3 WhatsApp databases that I believe came from the same device. Thank you Filipe!

Well, here are my conclusions... From past observations, I believe that when the phone owner changes the WhatsApp number, the messages will continue to be inserted in the same database, so IPED will show as a single chat. In this case, however, there are more than one number being used (probably through WhatsApp Business or some dual space application). I analyzed just a few examples (@filipesimoes feel free to add a counterexample here) of chats between the owner and one contact that came from different databases (and are shown as different chats in IPED), but in all of them messages were different. An example below: image

In this example, Contact XYZ knew that he/she was chatting with the same person. But I saw cases where different WhatsApp numbers were used in the same device as different "personas"...

In general, mixing chats doesn't seem a good idea to me, as they are different chats in the application itself (if you look through the device).

There is also another case, when both numbers of the owner are members of the same group. Both group chats should contain the same messages (during the period that both numbers were part of the group), except for deleted messages.

In general, optionally merging chats may be useful to read conversations, but it seems hard to find a simple solution that works in all cases, as chats may also come from different devices (used by the same person).

@lfcnassif, any thoughts about this?

lfcnassif commented 5 months ago

The owner number is not stored into the database, we get it from external files. If I remember, not sure, the decoded chats are not separed by owner number (e.g. in a Map), but by database. So if messages are saved into the same database after the owner number changes, I think they would appear into the same chat, unless a new chat ID is created into the database, which I guess is not the case...

If a new database is created after owner number changes, I think they would appear as separate chats. We already have a feature to merge chats from different databases/backups, that is based on a minimum number of chats with a minimum number of equal messages that should be present in the databases to be merged. If a new database is created after owner changes and if a criteria exists to link the old and the new DBs, we theoretically could merge them. But I agree with @wladimirleite point about displaying chats separately if they show separately on the device screen. If they show as the same conversation on the device and IPED is breaking them, I think we should improve to have the same native application behavior.

wladimirleite commented 5 months ago

In this case shared by @filipesimoes, it doesn't seem to be a number change, but different WhatsApp instances using different numbers.

lfcnassif commented 4 months ago

@filipesimoes, did you confirm @wladimirleite's observations? If yes, could we close this?

lfcnassif commented 3 months ago

Closing. Please reopen if you find a new chat ID is created in the database when the owner number changes.