Investigating Viber PC
09/02/2021 Tuesday
Viber PC is a Japanese corporation Rakuten's that provides cross-platform voice-over IP (VoIP) and instant messaging (IM) web service. Viber PC allows users to send any kind of message such as text, video, contact info, and audio, and to exchange and share data with other users. In addition to that, Viber PC is available on Windows, macOS, Linux, Android, and iOS devices.
Digital Forensics Value of Viber PC Artifacts
In Viber PC artifacts provide information about phone/video calls, messages, and the application configuration data. Viber stores chats on devices members. New chat messages are stored in the Viber cloud and can be retrieved from there. This information is critical during the forensic analysis process as it helps us understand the types of artifacts that are likely to remain for digital forensics investigators.
Location of Viber PC Artifacts
In Windows 10 Viber PC artifacts are located at C:\Users\username\AppData\Roaming\ViberPC
Structure of Viber PC Artifacts
Viber PC artifacts are found in three SQLite databases: config.db which contains information about the ac-counts settings, data.db which contains the auxiliary data, and viber.db which contains information about Viber messages, calls, and contacts.
Analyzing Viber PC Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to extract Viber PC artifacts from Windows machines and what kind of digital forensics insight we can gain from the artifacts.
After you have created your case and added evidence for the investigation, at the Artifact Parser Selection Phase, you can select Viber PC artifacts:
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Viber PC artifacts in ArtiFast software.
Viber PC Calls Artifact
- Caller - The caller number.
- Call Status - Call status (answered/missed).
- Call Type - Call type (voice call/video call).
- Is Seen - Indicates whether the call is seen or not.
- Duration - Call duration.
- Receiver - Call receiver number.
Viber PC Chats Artifact
- Sticker ID - The sticker ID.
- PayLoad Path - Chat payload path.
- Receiver - Chat receiver number.
- Is Read - Indicates whether the chat is read or not.
- Sender - Chat sender number.
- Message Type - Chat type.
- Message Body - Chat body.
- Direction - Chat direction (outgoing/ingoing).
Viber PC Settings Artifact
- Backgrounds Folder - Application backgrounds folder.
- Default Phone Prefix - Default phone prefix.
- Is Download Photo And Video - Indicates whether media downloading is enabled.
- Is Incoming Calls - Indicates whether incoming calls are enabled.
- Avatar Folder - Avatar folder path.
- Is Messages - Indicates whether messages are enabled.
- Is Show Picture - Indicates whether showing picture is enabled.
- Start Viber when Windows starts - Indicates whether Viber is enabled to start upon system startup.
- Download Folder - Download folder file path.
- Thumbnail Folder - Thumbnail folder file path.
- Is Save Messages - Indicates whether saving messages is enabled.
- Phone Number - The user phone number.
- Port - The used port number.
- Enable Proxy - Indicates whether the proxy is enabled.
- Viber Version - Viber version.
- Wallpaper ID - Wallpaper ID.
- UI Language - The user interface language.
- Number Of Launches - Indicates the number of times the application was launched.
- Host Proxy - Application host proxy.
- Version Installation Time - Date and time when the version was installed.
