As we know that WeChat will wipe deleted chat messages. That's why forensic guys could  not dig out any deleted chat messages in EnMicroMsg.db. Is it possible to let those deleted chat messages show up again?

For performance's sake, WeChat will created index for better user experience. That's the key point for forensic guys to recover those deleted chat messages or contacts. Let me show you where the index exists as below.

Look into the table "FTS5IndexMessage_content"  and "FTK5IndexContact_content" and we could find all chat messages and contacts. No doubt those deleted chat messages or contacts still exist in these tables. Suspect may delete chat messages but no way he/she could delete index database.

Of course suspect may uninstall WeChat and its folder "com.tencent.mm" will no longer exists. But forensic guys could still recover content of WeChat by deep recovery on image acquired from an Android phone.

Those manufacturers of Mobile Forensic software should take it into consideration and their tools won't miss the deleted WeChat chat messages again.

Dig out WeChat deleted chat messages on Android Phone的更多相关文章

  1. WeChat 6.3 wipe deleted chat messages as well as LINE 5.3 and above

    Let me show you the WeChat version first. It is 6.3. What will happen to WeChat deleted chat message ...

  2. Dig out deleted chat messages of App Skype

    Last month Candy was arrested on suspicion of having doing online porn webcam shows, but Candy refus ...

  3. Let's see if we could reocver Line 5.3 and above deleted chat messages or not

    Forensic is a strict science and we should let the evidence speak for itself. Several months ago I s ...

  4. dig out deledted chat messages

    One of my friends asked me to do a favor for her. She said her friend deleted some important chat me ...

  5. No deleted LINE chat messages recovered on iOS 9.1 after UFED extraction

    The evidence is iPhone 5s with iOS 9.1 and not jail breaked. I use UFED to do advanced logical extra ...

  6. How to extract WeChat chat messages from a smartphone running Android 7.x or above

    A friend of mine she was frustarted in extracting WeChat chat messages from suspect's smartphone run ...

  7. how to extract and decrypt WeChat EnMicromsg.db on Android phone

    One of my friend came to me with an Android phone. She saild somehting wrong with the hardware of he ...

  8. Android Malware Analysis

    A friend of mine asked me help him to examine his Android 5.0 smartphone. He did not say what's wron ...

  9. 微信破解，解密？How To Decrypt WeChat EnMicroMsg.db Database?

    20元现金领取地址:http://jdb.jiudingcapital.com/phone.html内部邀请码:C8E245J (不写邀请码,没有现金送) 国内私募机构九鼎控股打造,九鼎投资是在全国股 ...

随机推荐

  1. js数组操作-添加，删除

    js 数组操作常用方法. push():在数组后面加入元素,并返回数组的长度 unshift():在数组前面加入元素,并返回数组的长度 pop()删除最后一个元素 shift()删除第一个元素 var ...

  2. Java核心技术（Java白皮书）卷Ⅰ 第一章 Java程序设计概述

    第1章 Java程序设计概述1.1 Java程序设计平台 具有令人赏心悦目的语法和易于理解的语言,与其他许多优秀语言一样,Java满足这些要求. 可移植性 垃圾收集 提供大型的库  如果想要有奇特的绘 ...

  3. View学习（四）-View的绘制（draw）过程

    View的draw过程相比之于measrue过程,也是比较简单的.并且在我们自定义View时,也经常需要重写onDraw方法,来绘制出我们要实现的效果. 如之前的文章所说,绘制的流程也是起始于View ...

  4. 豹哥嵌入式讲堂：ARM开发之文件详解（3）- project文件

    大家好,我是豹哥,猎豹的豹,犀利哥的哥.今天豹哥给大家讲的是嵌入式开发里的project文件. 前面两节课里,豹哥分别给大家介绍了嵌入式开发中的两种典型input文件:source文件.linker文 ...

  5. jQuery 效果函数（三）

    方法 描述 animate() 对被选元素应用“自定义”的动画 clearQueue() 对被选元素移除所有排队的函数(仍未运行的) delay() 对被选元素的所有排队函数(仍未运行)设置延迟 de ...

  6. Android Ptrace Inject

    之前介绍了Android平台上3种常见的hook方法,而hook的前提是进程注入,通过进程注入我们可以将模块或代码注入到目标进程中以便对其空间内的数据进行操作,本篇文章介绍基于ptrace函数的注入技 ...

  7. 原生JavaScript如何解决父元素查找指定类名的子元素的问题

    问题:已知一个元素的类名是right并且这个元素的祖先元素的类名为parent,现在想通过原生JavaScript获得这个类名为right的元素. 我的思路:利用递归.先判断已知的祖先元素(题中的pa ...

  8. ssh的免密登陆

    想必大家都有使用ssh登陆的过程了,那么,怎么设置ssh免密登陆呢?下面有一些我的总结: 环境:服务器主.从 主服务器:192.168.1.1 从服务器:192.168.1.2 实现主服务器ssh登录 ...

  9. OTCBTC上线币币交易

    我们在这里很高兴的宣布,OTCBTC 的币币交易区,即将在 2018/01/11 于 08:00 上线. 这个币币交易区,将会跟所有现有的交易所很不一样,我们将开放用户自主上币,且所有品种不收任何上架 ...

  10. Jerry的UI5框架代码自学教程

    SAP UI5对View元素基于jQuery的操作方式,使得其学习曲线相对Angular/React来说比较平缓,至少对于我个人而言是这样.对于已经有jQuery经验的前端开发人员来说很容易上手. 使 ...