Your Browser Is Keeping Years of Your WhatsApp
A forensic deep-dive into WhatsApp Web: where its data lives on disk, what sits there in plaintext, the one thing that is encrypted, and how it was reversed.
Tagged “Browser forensics”
2 posts
-
-
Zone.Identifier: what the Mark of the Web records about a download
How Windows marks downloads in an NTFS alternate data stream: where it lives in the MFT, the zone and URL keys, hunting it at scale, and how it disappears.