检索结果-内蒙古大学图书馆

Forensic analysis of instant messaging apps: Decrypting Wickr and private text messaging data

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION 2021年 37卷

作者： Kim, Giyoon Kim, Soram Park, Myungseo Park, Younjai Lee, Insoo Kim, Jongsung Kookmin Univ Dept Financial Informat Secur 77 Jeongneung Ro Seoul 02707 South Korea Kookmin Univ Dept Informat Secur Cryptol & Math 77 Jeongneung Ro Seoul 02707 South Korea Prosecutors Off Digital Invest Div 157 Banpo Daero Seoul 06590 South Korea

Currently, obtaining digital evidence from instant messaging (IM) apps is being considered. IM apps store personal user data, e.g., user information, chat messages, and multimedia files, most IM apps protect the stored data using secure cryptographic algorithms such that only an authorized person can access the app data. Accordingly, it is important to develop a decryption method for IM app data for digital forensic investigations. In this paper, we present how the database and main files of IM apps are stored and encrypted, as well as how the apps verify passwords. We also present a decryption methodology for the databases and multimedia files of two IM apps, i.e., Wickr and Private Text Messaging, which provide various secure communications, e.g., text messages and multimedia files. The decrypted data of these IM apps was verified in simulations. (c) 2021 Elsevier Ltd. All rights reserved.

关键词： Wickr Private text messaging database decryption Instant messenger

来源：评论

学校读者我要写书评

暂无评论

A study on the decryption methods of telegram X and BBM-Enterprise databases in mobile and PC

引用

FORENSIC SCIENCE INTERNATIONAL-DIGITAL INVESTIGATION 2020年 35卷

作者： Kim, Giyoon Park, Myungseo Lee, Sehoon Park, Younjai Lee, Insoo Kim, Jongsung Kookmin Univ Dept Financial Informat Secur 77 Jeongneung Ro Seoul 02707 South Korea Kookmin Univ Dept Informat Secur Cryptol & Math 77 Jeongneung Ro Seoul 02707 South Korea Prosecutors Off Digital Invest Div 157 Banpo Daero Seoul 06590 South Korea

Instant messenger (IM) apps, which store a variety of behavioral information about users, such as secret chats, group chats, and file sharing, are important tools for digital forensics investigation. Messenger apps on mobile devices store user-friendly data, but data collection can be difficult due to various constraints. PC messenger data, on the other hand, can be collected relatively easily, but tend to be less informative than data from mobile messengers. Most messengers are cross-platform, supporting both mobile devices and PCs, and providing synchronization services, a situation which can overcome the constraints of data extraction for evidence acquisition. This allows for complementary interaction when extracting data generated by the use of IMs. However, some IMs encrypt their data for protection against external threats. The use of encryption can effectively protect the user's data, but poses a significant challenge to digital forensics, in which data should be decrypted to be used as evidence. Such IMs normally use a combination of key derivation functions and cryptographic algorithms to encrypt data. It is therefore necessary to identify the relationships between the functions used for encryption, in order to decrypt IM data, so that it can be used as evidence, and to determine the secret values used for generating keys. In this paper, we propose methods for acquiring user data, including conversation history protected by encryption by analyzing the Telegram X and BBM-Enterprise apps that perform in various mobile and PC operating environments. Both applications encrypt their databases using an SQLite extension module called SQLCipher. In order to decrypt these databases, we identified the parameters of SQLCipher, and derived a Passphrase, the main secret. In addition, We validated our approach by conducting an experiment to decrypt the encrypted databases of Telegram X and BBM-Enterprise. (C) 2020 Elsevier Ltd. All rights reserved.

关键词： Telegram X Unigram BBM-Enterprise database decryption Instant messenger

来源：评论

学校读者我要写书评

暂无评论

The Forensic Analysis of WeChat Message 6

The Forensic Analysis of WeChat Message

引用

6th International Conference on Instrumentation and Measurement, Computer, Communication and Control (IMCCC)

作者： Zhang, Lijun Yu, Fei Ji, Qingbing Sci & Technol Commun Secur Lab Chengdu 610041 Peoples R China

ISBN: (纸本)9781509011957

WeChat is a popular instant messaging application on Android, iPhone and BlackBerry smart phones, whose chat messages are all stored in local installation folder. This paper studied the data forensic techniques of WeChat messages including the identification of storage location, storage structure and information extraction methods. Since the text message is stored in encrypted SQLite database, we detailedly analyze its cryptographic algorithm, key derivation principle and present the corresponding database decryption process in different practical forensic circumstances. In addition, we exploit the data recovery of voice and deleted messages which would also be helpful in data forensic for criminal investigation.

关键词： WeChat database decryption key derivation data forensics

来源：评论

学校读者我要写书评

暂无评论

The Forensic Analysis of WeChat Message

The Forensic Analysis of WeChat Message

引用

2016 Sixth International Conference on Instrumentation and Measurement,Computer,Communication and Control (IMCCC2016)(第六届仪器测量、计算机通信与控制国际会议)

作者： Lijun Zhang Fei Yu Qingbing Ji Science and Technology on Communication Security Laboratory Chengdu 610041 China

ISBN: (纸本)9781509011964

WeChat is a popular instant messaging application on Android,iPhone and BlackBerry smart phones,whose chat messages are all stored in local installation *** paper studied the data forensic techniques of WeChat messages including the identification of storage location,storage structure and information extraction *** the text message is stored in encrypted SQLite database,we detailedly analyze its cryptographic algorithm,key derivation principle and present the corresponding database decryption process in different practical forensic *** addition,we exploit the data recovery of voice and deleted messages which would also be helpful in data forensic for criminal investigation.

关键词： WeChat database decryption key derivation data forensics

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：