Computer Engineering and Applications ›› 2021, Vol. 57 ›› Issue (23): 146-153.DOI: 10.3778/j.issn.1002-8331.2007-0284

• Network, Communication and Security • Previous Articles     Next Articles

Recovery Method of WeChat Revoking Message Based on Dynamic Memory Analysis

NI Xueli, LIANG Guangjun   

  1. 1.Department of Computer Information and Cyber Security, Jiangsu Police Institute, Nanjing 210031, China
    2.Jiangsu Electronic Data Forensics and Analysis Engineering Research Center, Nanjing 210031, China
    3.Key Laboratory of Digital Forensics, Jiangsu Provincial Public Security Department, Nanjing 210031, China
  • Online:2021-12-01 Published:2021-12-02

引入动态内存分析的微信撤回消息恢复方法

倪雪莉,梁广俊   

  1. 1.江苏警官学院 计算机信息与网络安全系,南京 210031
    2.江苏省电子数据取证分析工程研究中心,南京 210031
    3.江苏省公安厅 数字取证重点实验室,南京 210031

Abstract:

As an instant messaging system favored by users, WeChat not only brings great convenience to people’s lives, but also provides criminals with new methods and tools for illegal crimes. WeChat chat records, as a type of electronic evidence clearly listed in Chinese laws, have attracted wide attention for their validity, making WeChat chat records recovery a research hotspot in related fields. Most of the existing research on the recovery of chats focuses on the recovery of deleted messages, while the recovery of revoking messages has not made effective progress. By studying the dynamic memory management mechanism of PC WeChat, this paper analyzes the characteristic characters and field structure of the revoking message in dynamic memory. By comparing the storage principles of different types of messages such as text, emoticons, pictures, etc, a method of recovering WeChat revoking messages based on dynamic memory analysis is proposed. Finally, a tool written in Python language is used to achieve batch recovery of the revoking messages such as text, status of revocation, WeChat ID , etc, which verifies the effectiveness of this method.

Key words: dynamic memory, revoking message, data recovery, digital forensics, Python

摘要:

作为广受用户青睐的即时通信系统,微信在给人们生活带来极大便利的同时,也给不法分子提供了违法犯罪的新手段、新工具。微信聊天记录作为我国法律中明确列出的电子证据类型,其有效性引起广泛关注,使得微信聊天记录的恢复成为相关领域的研究热点。针对现有的聊天记录恢复研究多集中于删除消息的恢复,撤回消息的恢复尚未取得有效进展,通过研究PC版微信运行过程中的动态内存管理机制,分析撤回消息在动态内存中的特征字符及字段结构,对比文本、表情、图片等不同类型的消息在内存中的存储原理,提出一种基于动态内存分析的微信撤回消息恢复方法。利用Python语言编写的工具实现了对微信撤回消息原文、撤回状态、撤回方微信ID等内容的批量恢复,验证了该方法的有效性。

关键词: 动态内存, 撤回消息, 数据恢复, 电子数据取证, Python