IPED
IPED copied to clipboard
Investigate WhatsApp deleted messages with "trash" status
Copied from https://github.com/sepinf-inc/IPED/pull/2287#issuecomment-2423211691:
About commit ce22a6c, has anyone observed some new column in WA messages table with a name similar to "deleted" and values like "trash" or meaning that? A colleague reported to me CellebriteReader reports several messages as deleted=trash, while the same messages are displayed by IPED's internal parser as allocated messages (not deleted). Just a guess, maybe WA is just tagging messages as deleted to later (in the night?) delete them from database in idle moments...
~~PS: On cellphone screen, I think those deleted=trash messages are not shown, I will double check with him.~~ PS2: Or maybe there is another table with the trash status column that could be joined with the messages table...