WeChat App Security Analysis

Running head: DIGITAL FORENSIC ON WECHAT ON ANDROID
Digital Forensic on WeChat on Android
Name of the Student
Name of the University

1DIGITAL FORENSIC ON WECHAT ON ANDROID
Table of Contents
1. Introduction:................................................................................................................................2
2. Development:...............................................................................................................................3
2.1 Installation paths and data acquisition...................................................................................3
2.2 Decrypting the messages database.........................................................................................4
2.3 Communication records.........................................................................................................5
2.4 Moments................................................................................................................................6
2.5 Conversion of Audio File Format:.........................................................................................7
3. Conclusion:..................................................................................................................................9
Reference List:...............................................................................................................................10

2DIGITAL FORENSIC ON WECHAT ON ANDROID
1. Introduction:
The selected topic is forensic analysis of WeChat on Android phones. In the whole world,
WeChat can be considered as one of the most used IM or instant messaging android application.
By 2015, WeChat achieved six-hundred and ninety seven million of users from all over two
hundred countries. The article has presented WeChat forensic through five stages such as
installation path and data acquisition, decrypting the message database, communication of
records, moments and conversion of audio file format. The use of the world wide based
application is being extensively increasing each year. Moreover, various criminals are currently
using the application for illegal activities. The application has two basic functionalities such as
chat and moments. In the chat section, the user communicate with other person and in the
moments section, the user shares the life events.
Wu et al. (2017) has provided various information regarding the forensic of the
application on the android devices and analyzed all those gathered data into bounded parameter.
This study has reviewed all those information that was provided into the journal. Moreover,
critically reviews the process of investigating and data gathering process of the author. For better
understanding of the topic various other journals have been accessed and information gathered
from those articles has also been included into this study. The comparison between the
information provided in the articles can be visualized into the study.
This study includes the information gathered from various articles regarding the forensic
investigation of WeChat. The actual study is based on the data gathered by various articles
during investigation of WeChat on android devices. These investigations are the process of

3DIGITAL FORENSIC ON WECHAT ON ANDROID
acquiring data of WeChat and decoding the encrypted database, what was communicated by the
user and whom did he/she communicate and the information shred through the moments.
2. Development:
2.1 Installation paths and data acquisition
For the installation of the Wechat application ann installation path is required to be
specified on the android device and by default the path of the application is set as
“/data/data/com.tencent.mm/” and “/sdcard/Tencent/MicroMsg”. The sub directories are created
in the installation location for storing the chat records and the media files. For storing the
configuration of the application “com.tencent.mm” is used. It acts as the database of the
application and the authentication of the users and cache data are also stored here. The directory
created MicroMsg is used for storing the record of the user and activity in WeChat (Wu et al.,
2017). A unique number is created in WeChat for representing the identity of the user and a
personal data folder is created in the installed location “/data/data/com.tencent.mm/MicroMsg”.
Encryption is applied and the personal folder appears using the MD5 number transformed from
the user unique ID. The user directory is also used for storing the multimedia files under the path
“/sdcard/Tencent/MicroMsg”. The multimedia files can be of different types such as audio,
pictures, gifs, videos, etc (Gao & Zhang, 2013). For each of the user a private encrypted folder is
created using the MD5. Rooting the android device can give access permission for the
“com.tencent.mm” directory and it can be used for getting digital evidence from the android
device. The data can be extracted directly from the rooted android device and exported using the
Android Debug Bridge command (adb). The adb pull command is used for accessing the
directory “/data/data/com.tencent.mm”. In case of the unrooted android devices the data cannot