Homec4science
Diffusion sqlcipher_carve_dataset (main) Browse

R12774/README.md
502f9b7e65e8main

Last Change
Raw File

README.md
View Options

## SQLCipher forensic datasets
### Dataset 1
Signal application 6.6.0.14 on iOS 15.6.1
Two files:
- signal.sqlite (sha1: 1f3bd6bbc8b36a54a00d3fd86307ce69c1bf6e61)
- signal.sqlite-wal (sha1:82bca3cf580fdbdc723385129a0166dbaa5fb9eb)
Keychain data:
```
<dict>
<key>SecAccessControl</key>
<data>
MQ0wCwwEcHJvdAwDY2t1
</data>
<key>TamperCheck</key>
<data>
OTFFMEVDNDUtODAyOS00NTU3LUE0OUEtMkZCNTA2QTgyNjM1
</data>
<key>UUID</key>
<data>
NzQ1MkMxMjAtRTg4Mi00RUFCLUEzQjQtNDk3MTI5NzNCREZE
</data>
<key>acct</key>
<data>
R1JEQkRhdGFiYXNlQ2lwaGVyS2V5U3BlYw==
</data>
<key>agrp</key>
<data>
VTY4TVNETjZEUi5vcmcud2hpc3BlcnN5c3RlbXMuc2lnbmFs
</data>
<key>cdat</key>
<data>
MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
</data>
<key>clas</key>
<integer>10</integer>
<key>mdat</key>
<data>
MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
</data>
<key>musr</key>
<data>
</data>
<key>pdmn</key>
<data>
Y2t1
</data>
<key>persistref</key>
<data>
Ix+EtwAgSuuK3++Ar8fiqw==
</data>
<key>rowid</key>
<integer>322</integer>
<key>sha1</key>
<data>
nrK86YJoXxtDA3zvrR0ZRL1Ja4o=
</data>
<key>svce</key>
<data>
R1JEQktleUNoYWluU2VydmljZQ==
</data>
<key>sync</key>
<data>
MA==
</data>
<key>tomb</key>
<data>
MA==
</data>
<key>v_Data</key>
<data>
FRmVWPo3xEdJzF9rXoWVxTjRCTnZFwYN5SftfOjob0nw35pGuSmw
lnC/ZZM+Erfe
</data>
</dict>
```
### Dataset 2
Signal application 6.6.0.14 on iOS 15.6.1
Two files:
- signal.sqlite (sha1: 53fa87d0ad4eb8452274b0628be7b001c5a3e3e8)
- signal.sqlite-wal (sha1:2dac01357b3f03fe784ff3a7dea21bd5d77a980c)
Keychain data:
```
<dict>
<key>SecAccessControl</key>
<data>
MQ0wCwwEcHJvdAwDY2t1
</data>
<key>TamperCheck</key>
<data>
OTFFMEVDNDUtODAyOS00NTU3LUE0OUEtMkZCNTA2QTgyNjM1
</data>
<key>UUID</key>
<data>
NzQ1MkMxMjAtRTg4Mi00RUFCLUEzQjQtNDk3MTI5NzNCREZE
</data>
<key>acct</key>
<data>
R1JEQkRhdGFiYXNlQ2lwaGVyS2V5U3BlYw==
</data>
<key>agrp</key>
<data>
VTY4TVNETjZEUi5vcmcud2hpc3BlcnN5c3RlbXMuc2lnbmFs
</data>
<key>cdat</key>
<data>
MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
</data>
<key>clas</key>
<integer>10</integer>
<key>mdat</key>
<data>
MjAyMTA5MTcxMzMyNTUuMTk4NjA5Wg==
</data>
<key>musr</key>
<data>
</data>
<key>pdmn</key>
<data>
Y2t1
</data>
<key>persistref</key>
<data>
Ix+EtwAgSuuK3++Ar8fiqw==
</data>
<key>rowid</key>
<integer>322</integer>
<key>sha1</key>
<data>
nrK86YJoXxtDA3zvrR0ZRL1Ja4o=
</data>
<key>svce</key>
<data>
R1JEQktleUNoYWluU2VydmljZQ==
</data>
<key>sync</key>
<data>
MA==
</data>
<key>tomb</key>
<data>
MA==
</data>
<key>v_Data</key>
<data>
FRmVWPo3xEdJzF9rXoWVxTjRCTnZFwYN5SftfOjob0nw35pGuSmw
lnC/ZZM+Erfe
</data>
</dict>
```
### Dataset 3
Signal application 5.51.7 on Android 11
Two files:
- signal.db (sha1: 73285c288a2d87b6266f669bd531bae4c7dcec5b)
- signal.db-wal (sha1:3e80898595ecaf0023cb618b11fa25da559d2add)
Keystore data :
```
"org.thoughtcrime.securesms": [
{
"result_type": 1,
"description": "pref_database_encrypted_secret",
"encrypted_data": "11fa79235a154a23a616511096ad39a415adabacccc80dd916c90cd9f9f2b19657227de684759027be23b57d10b4c579",
"decrypted_data": "c06927f4386757ab0ec0bc7c80bca674ab027309e517976de79cd35b5518b5ed"
},
]
```
c4science · Help