{"id":133,"date":"2015-10-23T11:00:48","date_gmt":"2015-10-23T11:00:48","guid":{"rendered":"https:\/\/www.acquireforensics.com\/blog\/?p=133"},"modified":"2016-01-27T09:28:28","modified_gmt":"2016-01-27T09:28:28","slug":"wechat-forensics-analysis","status":"publish","type":"post","link":"https:\/\/www.acquireforensics.com\/blog\/wechat-forensics-analysis.html","title":{"rendered":"Unveiling Of Cyber Crime Evidence With WeChat Forensics Analysis"},"content":{"rendered":"<p>WeChat is a text and voice messaging service developed in China. The application can be used both on smartphones such as Android, iPhone, Windows Phone, BlackBerry as well as on web-based operating systems like Windows and OS X. For the operating systems, however, WeChat needs to be installed on a supporting mobile for the authentication purposes. In addition to this, they also do not possess message roaming and moments.<\/p>\n<p>With the availability of WeChat on both mobile phones and operating systems, the count of cybercrimes committed through it has substantially increased. Therefore, this requires a potential WeChat forensics approach for extraction of messages in order to prove the culprit guilty in the lawsuit. The following sections deal with the extraction and storage of WeChat messages from its default storage database.<\/p>\n<h2><strong>WeChat Analysis &#8211; Where Are WeChat Messages Stored?<\/strong><\/h2>\n<p>WeChat does not make use of a database directory. On the contrary, MicroMag serves to be its equivalent. The directory present in the MicroMag contains the <strong>EnMicroMsg.db<\/strong> database. This file stores all the chat messages of WeChat. However, this database is encrypted by using <strong>SQLCipher<\/strong>. It is an open source extension that is used for encrypting the entire database with 256-bit AES encryption. Nevertheless, the positive aspect about this encryption is that, the key for decrypting the file is present on the device itself.<\/p>\n<p><a title=\"WeChat Forensics\" href=\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/10\/data1.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-136 size-full\" src=\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/10\/data1.png\" alt=\"WeChat Analysis\" width=\"598\" height=\"232\" \/><\/a><\/p>\n<p>During WeChat forensics, there are four different parameters, which are used to encrypt and decrypt the data stored in EnMicroMsg.db. These are:<\/p>\n<ul>\n<li><strong>PRAGMA key: <\/strong>KEY<\/li>\n<\/ul>\n<p>This parameter is used for setting the key that needs to be use with the database.<\/p>\n<ul>\n<li><strong>PRAGMA cipher_use_hmac:<\/strong> off<\/li>\n<\/ul>\n<p>This disables the use of per-page HMAC checks for compatibility with SQLCipher 1.1.<\/p>\n<ul>\n<li><strong>PRAGMA cipher_page_size: <\/strong>1024<\/li>\n<\/ul>\n<p>This is used for changing the default size of the page to improve performance.<\/p>\n<ul>\n<li><strong>PRAGMA kdf_iter: <\/strong>4000<\/li>\n<\/ul>\n<p>This parameter changes the count of iterations that are used with PBKDF2 key derivation.<\/p>\n<h2><strong>Manual Decryption Of EnMicroMsg.db Under WeChat Forensics<\/strong><\/h2>\n<p>In WeChat analysis to decrypt the EnMicroMsg.db file, the KEY plays the most important role. It is generated from the MD5 Hash value that is a combination of IMEI and UIN. Only the first 7 characters of the value generated by the MD5 hash is used as a KEY.<\/p>\n<p><strong>IMEI (International Mobile Identification Number<\/strong>) is the unique 15-digits number, which is written at the back of the mobile. You can also enter *#06# to see the IMEI number.<\/p>\n<p><strong>UIN<\/strong> (<strong>Unique Identifier)<\/strong> is the number that can be found from the WeChat application folder in the file <strong>system_cnfig_prefs.xml<\/strong>.<\/p>\n<p>The formula for generating the KEY with UIN and IMEI number is<\/p>\n<p><a href=\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/10\/location.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-139\" src=\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/10\/location.png\" alt=\"location\" width=\"648\" height=\"83\" \/><\/a><\/p>\n<p><strong>For example:<\/strong><\/p>\n<p>IMEI=357894356722095<\/p>\n<p>UIN=-3398231209<\/p>\n<p>KEY= MD5(357894356722095-3398231209)<\/p>\n<p>The<strong> MD5 <\/strong>hash value is <strong>cbfd3bcdb9d7606e885d667a78a9077f<\/strong><\/p>\n<p><strong>KEY=cbfd3bc<\/strong><\/p>\n<p>Therefore, the KEY to decrypt EnMicroMsg.db is cbfd3bc<\/p>\n<h3><strong>Python Script To Decrypt EnMicroMsg.db File<\/strong><\/h3>\n<p>While carrying out WeChat forensics to decrypt the EnMicroMsg.db file, the investigators can also make use of Python script. In addition to this; in WeChat analysis, you need to install <strong>pysqlcipher <\/strong>so as to use SQLCipher function.<\/p>\n<p>The Python script that has to be used is named as <strong><em>f<\/em><\/strong><em><strong>md_wechatdecipher.py<\/strong><\/em>. Two input files and one input from the user\u2019s end are needed to run this script. They are:<\/p>\n<ul>\n<li><strong>db<\/strong>\u2013 This is the main file that contains the WeChat messages.<\/li>\n<li><strong>xml<\/strong>\u2013 This file contains the UIN number.<\/li>\n<\/ul>\n<p>The input that the user needs to enter is <strong>IMEI <\/strong>of the mobile.<\/p>\n<p>The output files, which are generated after the script is run, are:<\/p>\n<ul>\n<li><strong>EnMicroMsg-decrypted.db<\/strong>\u2013 This is the decrypted file that will contain all the WeChat messages.<\/li>\n<li><strong>EnMicroMsg-decrypted.log<\/strong>\u2013 this is the log file which will contain all the information like UIN, IMEI and the KEY. In addition to this, it also contains MD5 and SHA1 values of EnMicroMsg-decrypted.db<\/li>\n<\/ul>\n<p>For running the script, put all the input folders in the same folder in which the Python script is saved. When it is prompted to enter the IMEI number, enter the IMEI number and you will be given the KEY and the EnMicroMsg.db file will be decrypted automatically.<\/p>\n<p>All the messages from the <strong>EnMicroMsg-decrypted.db<\/strong>\u00a0file can be extracted with the help of a <em><a href=\"http:\/\/www.acquireforensics.com\/products\/sqlite-forensic-explorer\/\" target=\"_blank\">Sqlite Database Browser<\/a><\/em>.<\/p>\n<p>In this blog, we have mainly focused on the extraction and forensic analysis of WeChat messages. The file, which is of main concern in WeChat forensics, is EnMicroMsg.db. The examiners can chose either the manual process or the Python Script to decrypt the file and extract the data from it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WeChat is a text and voice messaging service developed in China. The application can be used both on smartphones such as Android, iPhone, Windows Phone, BlackBerry as well as on web-based operating systems like Windows and OS X. For the operating systems, however, WeChat needs to be installed on a supporting mobile for the authentication [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":145,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13],"tags":[],"class_list":["post-133","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-android-application"],"_links":{"self":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/133","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/comments?post=133"}],"version-history":[{"count":2,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/133\/revisions"}],"predecessor-version":[{"id":167,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/133\/revisions\/167"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/media\/145"}],"wp:attachment":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/media?parent=133"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/categories?post=133"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/tags?post=133"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}