取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.



As we know that WeChat will wipe deleted chat messages. That's why forensic guys could  not dig out any deleted chat messages in EnMicroMsg.db. Is it possible to let those deleted chat messages show up again?


For performance's sake, WeChat will created index for better user experience. That's the key point for forensic guys to recover those deleted chat messages or contacts. Let me show you where the index exists as below.



Look into the table "FTS5IndexMessage_content"  and "FTK5IndexContact_content" and we could find all chat messages and contacts. No doubt those deleted chat messages or contacts still exist in these tables. Suspect may delete chat messages but no way he/she could delete index database.


Of course suspect may uninstall WeChat and its folder "com.tencent.mm" will no longer exists. But forensic guys could still recover content of WeChat by deep recovery on image acquired from an Android phone.

Those manufacturers of Mobile Forensic software should take it into consideration and their tools won't miss the deleted WeChat chat messages again.

posted on 2017-08-03 13:13  Pieces0310  阅读(967)  评论(0编辑  收藏  举报