[Case Study] Mobile Forensics: See How SalvationDATA Extracts and Decrypts from the Latest WeChat

Editor’s note: WeChat has recently released a major update on both Android and iOS, bringing plenty of new features and even updates on its data structure. This poses great challenges to digital forensics because the updates tend to make current forensic products obsolete. Well known for our good support of Chinese devices and apps, SalvationDATA definitely doesn’t want to be left behind. With the efforts of our digital forensic experts, we now proudly announce that we are the industry-first to support the extraction and decryption of the latest WeChat (v7.0.0).

What’s new in WeChat 7.0.0?

WeChat 7.0.0 for iOS was released on Dec 21th, 2018, while WeChat 7.0.0 for Android was released on Dec 30^th, 2018.

We can easily find the update history from an app store and know what new features have been added in Wechat. In this new release, Wechat has introduced a whole new feature called the “Time Capsule”. This is a short video recording and sharing function, which may also possibly contain leads or evidence. And thanks to our product team, this newly introduced feature has already been supported for extraction by our SPF Pro (SmartPhone Forensic System Professional).

If we take a closer look at this new version, we’ll be able to notice that there have been some changes in WeChat’s files, and encryptions as well. These changes directly impact the data extraction and recovery from WeChat application. But the good news is, our forensic experts have already figured out how the new encryption method works and applied the updates to our mobile forensic product SPF Pro so that you will have no issue extracting and recovering data from the latest Wechat application.

How to extract data from WeChat 7.0.0?

Now let’s continue and have a brief look at how to extract data from the latest WeChat. As introduced before, WeChat data can be extracted directly from smartphone devices or app backup files. With the intelligent solution recommending feature of SPF Pro, you simply need to choose the most suitable extraction solution for your situation and then select WeChat for extraction.

Start the process and SPF Pro will automatically extract and recover user traces from Wechat. We’ve run tests to verify SPF Pro’s capability when dealing with WeChat 7.0.0, the result is satisfying, both normal and deleted data can be extracted as expected.

Conclusion

If you are interested in our forensic solutions, come and check out our website for more information. You can also go to our resource page to download our forensic products for free. We welcome you to contact us and claim your free product trial!