Forensic Acquisition of Data from a Crypt 12 Encrypted Database of Whatsapps

Abstract

Mobile phone devices have become popular among every age and social grouping in every society and are utilised by lots of people for different purposes. As the design of Mobile phones are continually evolving due to advancement in present technologies, applications that run on them are also being updated to fully utilise features on new devices. Due to the flexibility and portability coupled with applications that make communication easy and accessible, these devices are now mostly used to perform e-transactions, social networking and even criminal activities. One of such applications is WhatsApp which over various versions have tried to maintain the confidentiality and integrity of messages sent and received using WhatsApp. Securing of data from Criminals or unauthorized users called for constant updating of the encryption scheme of the SQLite database which is usually saved on the memory of the device on which it is installed. Over many updates of WhatsApp, the encryption has been changed from db.crypt, db.crypt5, db.crypt7, db.crypt8 to db.crypt12. There is need for forensic expert to constantly update their knowledge so as to get the needed information from the database. This study presents a forensic process of extracting WhatsApp data from db.crypt12, which is the latest SQLite Database encryption used by WhatsApp to secure stored communication data. The steps involve using some open source tools that can be downloaded for free on the internet.