Tag: Law Enforcement

Digital Forensics: Artifact Profile – WhatsApp Messenger

By

APPLICATION NAME: WhatsApp Messenger CATEGORY: Chat RELATED ARTIFACTS: WhatsApp Contacts, WhatsApp Messages OPERATING SYSTEMS: iOS, Android SOURCE LOCATION: iOS – /root/var/mobile/Applications/net.whatsapp.WhatsApp/Documents/ChatStorage.sqlite Android – /data/data/com.whatsapp/databases/msgstore.db Android – /data/data/com.whatsapp/databases/wa.db Android –/sdcard/WhatsApp/Databases/msgstore.db.crypt*   Importance to Investigators Android For Android devices, there are two SQLite databases of value for examiners recovering WhatsApp artifacts: msgstore.db and wa.db. The msgstore.db contains details on any chat conversations … Continued

Digital Forensics: Artifact Profile – Whisper

By

APPLICATION NAME: Whisper CATEGORY: Social Networking RELATED ARTIFACTS: Whisper Posts, Whisper Messages OPERATING SYSTEMS: iOS, Android SOURCE LOCATION: Android – %root%\data\APPsh.whisper\databases\w.db Android – %root%\data\APPsh.whisper\databases\c.db iOS – %root%\var\mobile\Applications\%GUID%\Documents\Messaging.sqlite iOS – %root%\var\mobile\Applications\%GUID%\Documents\Whisper.sqlite   Importance to Investigators Whisper is a popular social networking app that allows users to post messages anonymously and send messages to other users. It is available on both iOS and Android devices. Whisper allows … Continued

Digital Forensics: Artifact Profile – Yik Yak

By

APPLICATION NAME: Yik Yak CATEGORY: Chat RELATED ARTIFACTS: Yik Yak Notifications, Yik Yak Yaks OPERATING SYSTEMS: iOS SOURCE LOCATION: iOS – %root%\Library\Caches\engineering.locus.chatter\Cache.db iOS – %root%\Library\Caches\engineering.locus.chatter\fsCachedData\%GUID%   Importance to Investigators Yik Yak is a popular social media application most commonly used by young adults. The app, available on iOS and Android smartphones, allows users to post anonymous messages to … Continued

Finding and Analyzing Important Evidence in Child Exploitation Cases

By

Hosted by Magnet Forensics and Griffeye When it comes to investigating child exploitation, timing is critical. How can you get to key evidence, like pictures and videos, quickly to start building your case? In this recorded webinar, Magnet Forensics and Griffeye joined forces to demonstrate which tools and techniques can be used in your investigation to find, uncover, … Continued

July Artifact Update: Windows OS and More

By

We just released our July Artifact Update to Magnet IEF customers, which includes a number of new artifacts and improvements for previously supported apps. As part of this release, we wanted to improve support for Windows OS artifacts and integrate some popular customer requests. As a result, this update includes artifact support for the Recycle … Continued

April Artifact Update: Native Android Apps

By

Our latest artifact update for IEF includes support for native Android applications. As the mobile market continues to narrow-in on two primary operating systems – Android and iOS – it’s becoming increasingly important for investigators to recover data from these built-in system apps. In February, we added support for a similar set of native iOS … Continued

Making a Difference, One Child at a Time

By

By: Jad Saliba, Founder & CTO of Magnet Forensics It’s not an issue many like to talk about, or perhaps even know about. But child sex slavery is one of the fastest growing criminal enterprises in the world.  A perverse industry that preys on the poor, especially in economically disadvantaged countries, this kind of exploitation … Continued

Forensic Analysis of Windows Shellbags

By

This is the fifth and final blog post in a series about recovering Business Applications & OS Artifacts for your digital forensics investigations.  What are Shellbags? While shellbags have been available since Windows XP, they have only recently become a popular artifact as examiners are beginning to realize their potential value to an investigation.  Shellbags … Continued