Practical Mobile Forensics - Fourth Edition

Other methods of extracting application data

One of the easiest ways to parse application data is to create custom SQLite queries and Python scripts to parse data of interest. We have discussed several suggestions and examples of queries and scripts throughout this book. Python is one of the best solutions because it is free and we have full access to its libraries. One thing to keep in mind is that our scripts have to be updated frequently to keep up with application updates. Also, make sure that your encoding schemas are correct to prevent application artifacts from being missed or not interpreted correctly.

In addition to Python scripts, free parsers that support application extraction already exist. WhatsApp Extract is a free tool for ...