ForwardedMessages and ReplyMessages (whatsapp).

[gisms]

Hi everyone!

I was researching about forwardedMessages and ReplyMessages (whatsapp).
I found bug #997 which more or less describes the issue that we are experiencing.

Version 18.13: Decoding via external parser, ufdr forwardedMessages and ReplyMessages are flagged with an attachment. Decoding via ufdr internal parser, duplicates it and does not flag.

I build a iped version from source today, but only the duplication problem resolved, there is still no indication that it is a forwarded or reply message. And the external parser stopped to flagged it with attachment (wich I dont think is a good way).

Is this the scenario for now?
Would it be worth opening an issue to request that these types of messages, when decoded via external at least, to be flagged in a specific way?

[lfcnassif]

Please test latest 3.18.x snapshot: https://github.com/sepinf-inc/IPED/actions/runs/1982951751 and check if it works.

And the external parser stopped to flagged it with attachment (wich I dont think is a good way).

They are not attachments, past behavior was wrong.

Is this the scenario for now?

Now there are new properties ufed:ForwardedMessageData and ufed:ReplyMessageData you can use to filter by those messages types e.g.: ufed:ForwardedMessageData:* this will list forwarded instant messages in table tab.

Would it be worth opening an issue to request that these types of messages, when decoded via external at least, to be flagged in a specific way?

We already have an open issue to render them properly in Preview tab: #998. This is not scheduled for a future 3.18.x release. Of course, contributions are always welcome.

[lfcnassif]

I don't think it is a bug to stop it... just lack of functionality

[gisms]

I don't think it is a bug to stop it... just lack of functionality

Yes, true.

[lfcnassif]

In this version you sent and the one I built today, using external parser, it still duplicates for my case.

I can't reproduce this with latest 3.18.x link I sent and some ufdr samples I have here. Could you share your ufdr file privately, so I can confirm the issue and test a possible fix?

[lfcnassif]

Maybe have you used phoneParsersToUse = all? If that's the case, chats being duplicated is expected behavior. If not, I really need some sample ufdr to reproduce the issue and try to fix it.

[gisms]

I will do more tests with different versions and also models of cell phones and return. it will take longer but I'll be back