With this post I will give an overview on the app "Nandbox messenger" for Android.
Information on the app is available from https://nandbox.com/en/messenger/
I've used Android 6 and Nandbox 1.6.485 for my analysis.
To use the messenger you need to register via mail or phone number. Only one is possible.
The path of the application data is:
The used account can be found in the following file (sqlite-database):
The earliest entry is the account used in the app.
You can get the username, MSISDN (for this app this is either the mail address or the phone number), the time the account was created (time in unix epoch ms UTC).
Also you can find the ACCOUNT_ID. This is the primary key in the table and is used as identifier for e.g. messages.
Additionally to the way above you can get the used MSISDN from another file:
It is a XML-file. The key "msisdn" holds the value.
The contacts can also be found in the main database:
All entries except the earliest one.
All messages are stored in the main database:
Timestamps are in Unix Epoch (ms) UTC.
In the table you can also find the path to the media files sent/received (Column LOCAL_PATH)
The sent/received images are stored at:
The name is unique and can be mapped to the message in the database "courgette".
Additionally the images are stored in the cache folder:
Here the images have the name [LID]_base64.jpg. LID is the id of the message in the database "courgette"
Audio Files are called Voice Notes in this App. They are stored at:
The files have unique names and are m4a files. The names can be mapped to the messages in the database "courgette".
What happens when deleting messages?
Additionally I've tested what happens if a user deletes the message. One of the features of this app is the recall of messages even on the device of the communication partner.
I tested both sides. What happens on the side of the user who deletes and what happens on the device of the communication partner.
When deleting a message on the own device, the message is removed from the database. One can see that a message is missing because a LID is missing. I've not tested the recovery of the entry via carving.
If there was a media file in the message this file would be deleted in the file systems media folder. For an image this was
But the image is still available in the cache folder.
On the remote device you will see a message with the text "**message has been recalled**".
This is also the content in the database.
But: for media files the data is still available in the entry of the database. The path to the image/audio file is in there. And the files itself are also still in the filesystem
Finally, when the user on the remote device now deletes the message with the content "**message has been recalled**" the entry is deleted in the database. But a media file would not be removed from the file system.
Nandbox in hte used version doesn't use any encryption which makes the analysis simple. And the cache is a goldmine for media files sent or received.
I have not tested the group feature and also not tested the multiple profile feature. So a bit more testing can be done.
Hope you had a fun and informative read.