IPED icon indicating copy to clipboard operation
IPED copied to clipboard

Investigate WhatsApp deleted messages with "trash" status

Open lfcnassif opened this issue 4 months ago • 11 comments

Copied from https://github.com/sepinf-inc/IPED/pull/2287#issuecomment-2423211691:

About commit ce22a6c, has anyone observed some new column in WA messages table with a name similar to "deleted" and values like "trash" or meaning that? A colleague reported to me CellebriteReader reports several messages as deleted=trash, while the same messages are displayed by IPED's internal parser as allocated messages (not deleted). Just a guess, maybe WA is just tagging messages as deleted to later (in the night?) delete them from database in idle moments...

~~PS: On cellphone screen, I think those deleted=trash messages are not shown, I will double check with him.~~ PS2: Or maybe there is another table with the trash status column that could be joined with the messages table...

lfcnassif avatar Oct 18 '24 21:10 lfcnassif