WhatsApp Forensics: evidence hide-and-seek

05 Mar 2019
WhatsApp is without doubt the most popular messenger in the world with over 1.5 billion users globally. Thus, extracting complete evidence from WhatsApp Messenger is essential for any investigation. In this session, we will look into all possible sources where WhatsApp data might be stored (mobile devices, computers, cloud) and present our exclusive method of WhatsApp data extraction directly from the WhatsApp Server. Moreover, we will guide you through the process of WhatsApp backups decryption offering the alternative decryption method via phone number. Finally, we will explain how to extract WhatsApp data from a locked mobile device using a WhatsApp QR token from a PC.
Tanya Pankova, Marketing Manager - Oxygen Forensics