Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updated WhatsApp.tkape, .gitignore, Created WhatsApp_Media.tkape #887

Merged
merged 7 commits into from
Dec 1, 2023
Merged

Updated WhatsApp.tkape, .gitignore, Created WhatsApp_Media.tkape #887

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
cb9b772
Update Whatsapp.tkape - added locations for Microsoft Store Whatsapp
SolitudePy Nov 24, 2023
bf48036
Merge branch 'master' of https://github.com/SolitudePy/KapeFiles
SolitudePy Nov 24, 2023
c047253
Added *ConsoleLog.txt to .gitignore(created when running kape.exe)
SolitudePy Nov 24, 2023
3ffad92
Update WhatsApp.tkape metadata
SolitudePy Nov 24, 2023
ae1af9f
Create WhatsApp_Media.tkape
SolitudePy Nov 24, 2023
e5b9e61
Updated WhatsApp_Media.tkape comment
SolitudePy Nov 24, 2023
69b5eb0
Change to wildcards in whatsapp targets
SolitudePy Nov 24, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,3 +3,4 @@ gkape.exe
*.cli
.DS_Store
*.swp
*ConsoleLog.txt
15 changes: 13 additions & 2 deletions Targets/Apps/WhatsApp.tkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
Description: WhatsApp Local Files
Author: Matt Dawson
Version: 1.0
Author: Matt Dawson, SolitudePy
Version: 1.1
Id: a6f739e3-21fc-4942-9272-26d567f014da
RecreateDirectories: true
Targets:
Expand All @@ -14,6 +14,17 @@ Targets:
Category: Apps
Path: C:\Users\%user%\AppData\Roaming\WhatsApp\Local Storage\leveldb
Comment: "Copies the Local Storage leveldb of WhatsApp. Contains phone model and name of user, plus encrypted base64 strings which can be viewed with LevelDBDumper"
-
Name: Microsoft Store WhatsApp Cache
Category: Apps
Path: C:\Users\%user%\AppData\Local\Packages\*WhatsAppDesktop*\LocalCache\Roaming\WhatsApp\Cache
Comment: "Copies the cache of WhatsApp. Can be opened with Chrome Cache Viewer for viewing embedded thumbnails and other image artefacts, as well as extracting .enc message files or other files"
-
Name: Microsoft Store WhatsApp Local Storage
Category: Apps
Path: C:\Users\%user%\AppData\Local\Packages\*WhatsAppDesktop*\LocalCache\Roaming\WhatsApp\Local Storage\leveldb
Comment: "Copies the Local Storage leveldb of WhatsApp. Contains phone model and name of user, plus encrypted base64 strings which can be viewed with LevelDBDumper"


# Documentation
# https://belkasoft.com/whatsapp_forensics_on_computers
Expand Down
22 changes: 22 additions & 0 deletions Targets/Apps/WhatsApp_Media.tkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
Description: WhatsApp Shared Media Files
Author: SolitudePy
Version: 1.0
Id: b148236d-1064-42c4-bbb2-f08ad7aa8530
RecreateDirectories: true
Targets:
-
Name: Microsoft Store WhatsApp Desktop Profile Pictures
Category: Apps
Path: C:\Users\%user%\AppData\Local\Packages\*WhatsAppDesktop*\LocalState\profilePictures
Comment: "Copies the local store of contacts profile pictures, simply open with a photos software"
-
Name: Microsoft Store WhatsApp Shared Media
Category: Apps
Path: C:\Users\%user%\AppData\Local\Packages\*WhatsAppDesktop*\LocalState\shared\transfers
Recursive: true
FileMask: regex:.*\.(jpg|mp4|pdf|webp)
Comment: "Copies the shared media, can get very large."


# Documentation
# Whatsapp Desktop saves shared media locally, simply open it with a media software.