Darth Technology: Fragment-level data recovery technology after Android WeChat uninstall
Android system is the most installed smartphone system. According to the data published by the operator platform, the Android smartphone system occupancy rate is close to 70%. The same is true for smartphones encountered during the forensics process, and the number of Android phones is also amazing. However, the problem that the forensics often encounter is that WeChat has 700 million mobile client users, but when the evidence is obtained, it is found that the WeChat app in the mobile phone has been uninstalled. For the time being, there are very few tools for supporting data recovery and forensics after uninstalling Android WeChat. Next, let's take a look at the mobile data recovery software of Darth Technology.
According to Darth technology experts, WeChat's database EnMicroMsg.db, as well as uin and imei may be stored in the phone and will not be cleared. Based on this clue, Darth Technology seeks a variety of solutions. You need to find these three data in the full image of the phone to decrypt the database.
The phone serial number and uin are better to find, they are just records in a small file. But the key data: EnMicroMsg.db may have fragmentation when stored. How do we restore it? According to the storage structure, we search for the key in the full image. Value, and judge the 0 page of the database. If the database structure is met after decryption, we determine that the key value is the decrypted data of the encrypted database. The rest is to use this decryption data to decrypt the full image, and extract the matching message table, which is enough to restore the full content of Android WeChat.
After the principle was established, the engineers of Dath passed the test several times in the program, which proved the feasibility of the whole process. Let me look at a real case.
The first step is to get a full image of the Android phone that uninstalls WeChat app. This is explained in the previous chapter. You can also check out other technical articles from Dash. You can also use the Darth Mobile Data Recovery Software Professional Edition to get a full image.
The second step is to load the full image and get the serial number and uin and do the operation. As shown in Figure 1.
Figure 1. Get the serial number and uin
The third step is to decrypt the entire image and extract the WeChat chat record. This process is very complicated and the amount of calculation is relatively large, so it needs to have enough patience. The phone memory we tested was a 32G image that took 30 hours. We are working hard to optimize the algorithm to improve the efficiency of the operation.
Figure 2: Decrypted image operation in progress
The fourth step is to obtain the WeChat chat record, and after verification, the WeChat chat record after being uninstalled is successfully restored. As shown in Figure 3.
Figure 3: The chat record data recovery is successful after Android WeChat uninstall.
About Darth Technology
Darth Technology, a national high-tech enterprise, the only collaboration unit for the data recovery of the confidentiality of the Tianjin State Secrecy Bureau, the famous brand in the data recovery industry, leading the data recovery technology in China and even in Asia!
Darth Technology China Data Recovery and Forensics Experts! Hotline
More data recovery and forensics cutting-edge technology, please pay attention to WeChat public account: woocs
Micro signal: woocs
Long press to identify the QR code
Focus on data recovery and forensics technology, the Internet
Submission:
baby dual stool
With height step stool, give your baby independence, from reaching potty seat and brushing teeth. Even baby grow fast, the dual height design accommodates different ages and heights. Made of new and lightweight plastic, can bear 80kgs weight. We care about safety of baby as much as you do, that`s why the step stool features a slip-resistant design that provide a secure surface on all floor types.
Pack 12pcs in one carton. OEM is possible, use silk printing machine add custom`s logo, customized colors are also available. Let we know your demand, suitable recommendation would be provided within 2 days.
Quality is our culture, service is also what we emphasis. Choose us, you just give order, we will do the following all things, keep you posted on order details periodically, and delivery on time.
Baby Dual Stool,Baby Step Stool,Baby Toliet Stool,Dual Height Step Stool
​Taizhou Howawa Baby Products Co., Ltd. , https://www.howawa.com