04 · Messaging Apps
Android Messaging Apps Forensics: WhatsApp to RCS
How to acquire and analyse WhatsApp, Signal, Telegram and Google Messages on Android: where each stores chats, what encryption blocks, and what survives.
messagingwhatsappsignal
Area 04
Messaging Apps
Third-party messengers hold most of the conversation evidence on a modern phone, and each one stores it differently. This area covers WhatsApp's msgstore.db and wa.db and its encrypted crypt14 and crypt15 backups, Telegram's cache database, Signal's encrypted database and what can be recovered without the key, plus the chat exports users create themselves.
Key artifacts
- msgstore.db
- wa.db
- cache4.db
- *.crypt15
Artifacts in this area
- WhatsApp on Android: msgstore.db and wa.db
WhatsApp's Android databases and backups: msgstore.db message and chat tables, wa.db contacts, crypt14 and crypt15 backups, media paths and deleted messages.
Android 8-16
- Signal on Android: signal.db, Keys and Backups
Signal on Android: the SQLCipher signal.db, how its key is wrapped by the Android Keystore, encrypted attachments, .backup files and what survives outside.
Android 8-16
- Telegram on Android: cache4.db and Media
Telegram's Android cache4.db: messages_v2, dialogs, users and secret chats, TL-serialized blobs, per-account folders, media paths and what the cloud keeps.
Android 8-16
- Google Messages: bugle_db, SMS, MMS and RCS Chats
Google Messages' bugle_db database: RCS chats that never reach mmssms.db, SMS and MMS copies, participants, parts and attachments, timestamps and access.
Android 8-16