DFIRHub

Signal

Signal (Please view this tkape file for documentation on decryption!)

  • Apps
  • 4 paths
  • config.jsondb.sqlite
  • Per-user data
  • Version 1
  • Matt Dawson

Paths on disk

4 paths

Paths use Windows environment variable syntax

Notes

To decrypt db.sqlite on Windows:

1. Download https://sqlitebrowser.org/dl/ and open DB Browser for SQLCipher.exe

2. Get the key from config.json

3. Open the database from DB Browser/drag the file into the open window

4. Set the Password type from "Passphrase" to "Raw Key"

5. Set Encryption Settings to "SQLCipher 4 defaults"

6. Prefix the key from config.json with "0x" and paste it into the password field

References

7 links