iOS Advanced Recovery: Looking for Deleted Evidence of WhatsApp Activities

System type extraction, we will proceed with the analysis of the databases of both Apple Photos and Cloudkit-related artifacts to search for evidence related to the exchange of WhatsApp messages in order to verify the original presence of deleted communications and to attribute the receipt or sending of a file to a particular contact.

SANS DFIR Summit 2023

Speaker: Luca Cadonici, Digital Forensics Examiner, European Forensic Institute

View upcoming Summits: http://www.sans.org/u/DuS

advanced analysis apple artifacts communications databases exchange file ios messages order photos presence recovery search system the exchange verify whatsapp