All times are UTC - 5 hours [ DST ]




Post new topic Reply to topic  [ 11 posts ] 
Author Message
 Post subject: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 9th, 2022, 10:31 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
Hi,

I get more and more smartphone for DR. From time to time, I get case were user delete, change.. their whatsapp app and want to retrieve data and possibly restore Whatsapp as it was before.
Of course, cloud restore doesn't work for those user.

Anyone has a good way to work with Whatsapp ?

Thanks
CB


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 9th, 2022, 13:08 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2761
Location: Kuwait
suricate.ch wrote:
Hi,

I get more and more smartphone for DR. From time to time, I get case were user delete, change.. their whatsapp app and want to retrieve data and possibly restore Whatsapp as it was before.
Of course, cloud restore doesn't work for those user.

Anyone has a good way to work with Whatsapp ?

Thanks
CB


more details on highlighted in red

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 9th, 2022, 14:33 
Offline

Joined: July 31st, 2018, 12:30
Posts: 73
Location: Brasil
Not sure if uninstalling whatsapp would delete the database immediately.
Anyway, each case is a case, you can check for something like that :
"storage/emulated/0/WhatsApp/Databases/msgstore.db.crypt14"


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 10th, 2022, 3:32 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
einstein9 wrote:
suricate.ch wrote:
Hi,

I get more and more smartphone for DR. From time to time, I get case were user delete, change.. their whatsapp app and want to retrieve data and possibly restore Whatsapp as it was before.
Of course, cloud restore doesn't work for those user.

Anyone has a good way to work with Whatsapp ?

Thanks
CB


more details on highlighted in red

Case 1 : Let say customer delete Whatsapp application on Samsung S21+. Then she want to restore as it was before.
Case 2 : Customer play with Sim card, insert new SIM, Whatsapp detect it, says it's new SIM, so open the app as "new". When she insert back old SIM the Whatsapp doesn't restore as it was before.


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 10th, 2022, 3:33 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
grevan wrote:
Not sure if uninstalling whatsapp would delete the database immediately.
Anyway, each case is a case, you can check for something like that :
"storage/emulated/0/WhatsApp/Databases/msgstore.db.crypt14"

Thank you Grevan. So I could get this db and re-import it ?


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 10th, 2022, 11:18 
Offline

Joined: July 31st, 2018, 12:30
Posts: 73
Location: Brasil
Two options, try to decrypt the messages and give them to customer (there are some tutorials over the internet) or try to import to a new phone.
From what I've read, the only way to import the database is to first take a note where whatsapp databases are stored on the new phone, then you should uninstall it. The only way whatsapp can recognize the old data is from the first launch.
Then you copy the old database from your PC to the new phone path, you might have to create the database folders manually and they are case sensitive.
After that, install whatsapp and it may ask for backup recovery.
You can try to copy all database files/folders, not only "msgstore".

* Again, in your case 1 scenario, not very optimistic after uninstalling the software, but who knows.

Let us know your progress, looking forward to it.


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 11th, 2022, 2:21 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2761
Location: Kuwait
suricate.ch wrote:
einstein9 wrote:
suricate.ch wrote:
Hi,

I get more and more smartphone for DR. From time to time, I get case were user delete, change.. their whatsapp app and want to retrieve data and possibly restore Whatsapp as it was before.
Of course, cloud restore doesn't work for those user.

Anyone has a good way to work with Whatsapp ?

Thanks
CB


more details on highlighted in red

Case 1 : Let say customer delete Whatsapp application on Samsung S21+. Then she want to restore as it was before.
Case 2 : Customer play with Sim card, insert new SIM, Whatsapp detect it, says it's new SIM, so open the app as "new". When she insert back old SIM the Whatsapp doesn't restore as it was before.


Case1 - & Case2 , WhatsApp Always makes a backup either locally or in Cloud (no matter you like it or not) sometimes its hidden from regular users specially the new Android versions
I think starting from Android 11, the WhatsApp folder has changed to: Android--> Media__> com. whatsapp
you should find the backup db there, use any tool to decrypt it

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 12th, 2022, 3:38 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
Thank you for your answer.

I am going to try it with one of my phone to test.


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 14th, 2022, 4:40 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
Hi,

Another question. Do you have a good forum like HDDForum but for smartphone ? Only for DR, I am not intersting by flashing custom rom.

I have two other problem.

1. Huawei LYA-L29 - Mate 20 Pro - Device is working, booting.. I can enter the secure schema and unlock it but there's another lock that always stay. Customer doesn't know what secure schema he set.. so he can not access most of the app. When connected to PC, device is detected but doesn't allow transfer. This seems to be a specail security implemented by Huawei. When trying to enable USB debugging, it's asking for "secure schema"... customer doesn' know it.. it's not the same as the main one... so I can't access via adb function.

2. RedMi Note 10 - Stuck on mi logo. I can access menu but safe mode doesn't work and connecting to pcsuite.mi.com is not working... so last option is DATA wipe.

Thanks
CB


Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: June 14th, 2022, 10:12 
Offline

Joined: March 11th, 2021, 10:13
Posts: 134
Location: Switzerland
adding a pics of locked Huawei P20 Pro. Maybe I should start another post under forensics


Attachments:
p20_pro.JPG
p20_pro.JPG [ 44.97 KiB | Viewed 2966 times ]
Top
 Profile  
 
 Post subject: Re: Who is doing smartphone DR here ? Whatsapp DR
PostPosted: September 18th, 2022, 23:53 
Offline

Joined: March 17th, 2022, 21:24
Posts: 27
Location: Melbourne
suricate.ch wrote:
Hi,

I get more and more smartphone for DR. From time to time, I get case were user delete, change.. their whatsapp app and want to retrieve data and possibly restore Whatsapp as it was before.
Of course, cloud restore doesn't work for those user.

Anyone has a good way to work with Whatsapp ?

Thanks
CB


As mentioned above, the data is hidden in device memory, and it's encrypted. It might be possible to get the data still after deleting. But before I say anything more, I need to know the model of the phone?

Most modern mobile devices clear the pages quickly and start to overwrite the data on previously used blocks.
I assume the phone was turned into flight mode after receiving it, otherwise, the chances are getting slimmer.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 11 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group