Authors: Tanya Pankova
DFRWS EU 2019
Oxygen Sponsored Workshop
Link to downloads: https://dfrws.github.io/dfrws2019-EU-workshops/topic-06-Oxygen-WhatsApp-…
WhatsApp is without doubt the most popular messenger in the world with over 1.5 billion users globally. Thus, extracting complete evidence from WhatsApp Messenger is essential for any investigation. In this session, we will look into all possible sources where WhatsApp data might be stored (mobile devices, computers, cloud) and present our exclusive method of WhatsApp data extraction directly from the WhatsApp Server. Moreover, we will guide you through the process of WhatsApp backups decryption offering the alternative method, not incorporated in other forensic software. Finally, we will explain a new method of WhatsApp extraction via QR token taken from a computer.