Analysis and Acquisition of WeChat under Android 6.0

Abstract

Smart phone allows users to exchange instant messages, as well as share videos, audio’s and images instead of relying on desktop or laptop. Consequently it increases the portability and convenience for common users. Take China for example, WeChat has become the most universal Instant Messenger application in recently several years. In the meantime, forensic technicians start to pay attention to data contained in them. Furthermore, the potential evidence could be concealed in those devices and they are generally supposed to be recovered and extracted via utilizing the proper tools. In Android 6.0 and later version, the permissions are granted in runtime instead of installation. The difficulty of acquiring data is greater than before. This paper demonstrates a method on analyzing potential evidences on Android 6.0 Devices regarding WeChat.