Pieces0310

取证须让证物说话,莫妄以自我心证来给案情下定论.切忌画靶射箭,为找而找. 取证的根基仰赖经验与判断,在IT各领域的经验愈丰富,愈能看出端倪. 取证须善用工具,但不过度依赖工具.工具只能帮你缩小可能范围,但无法告诉你答案,仍需靠人进行分析判断.

首页 新随笔 联系 订阅 管理

A friend of mine she was frustarted in extracting WeChat chat messages from suspect's smartphone running Android 7.x. The situation is that no pattern lock/PIN/Password and USB debugging was enabled successfully. She tried every effort but in vain. No any commercial tools could help her to accomplish this task. I said to her:

“Our greatest weakness lies in giving up. The most certain way to succeed is always to try just one more time.” ―Thomas Edison

How to guarantee for extracting? All she need is:

1. Suspect's smartphone.

2.Install WeChat PC version on her laptop

3.A smartphone could be extracted by certain commercial tool without fail (Ex: support Bootloader mode or Smart ADB...)

 

I want her to take advantage of WeChat backup/restore function.  Let's take a look at it as below pics. 

 

Follow the steps as below:

1.Log in WeChat on her laptop with suspect's WeChat username and password. Don't forget the green check "Auto-sync" !!!


2. Click [Backup and Restore] on WeChat PC version.

3.Backup on PC then we could got backup files so as to restore to another phone we prepare.

4. Begin backup~

5.Backup completed~

6. Take a look where the backup file is.

7. Next is to restore backup chat messages to the phone we prepare.

8.Choose what we want to restore.

9. Start restoring

10.Restoring completed.

 11. Congratulations! That's the WeChat chat messages she want. Now she could use any commercial tool to extract the phone we prepare without fail. Finally she could focus on those chat messages and generate report by using commercial tool as usual.

 

posted on   Pieces0310  阅读(880)  评论(0编辑  收藏  举报
努力加载评论中...
点击右上角即可分享
微信分享提示