Whatsapp key Carver - would it be interesting to have this in IPED?

[leosol]

Hey guys, would you be interested in something like this in IPED: https://github.com/leosol/whatsapp-key-carver

Maybe I could work on a PR. Just tell me okay?

[leosol]

I guess, there is no need of a PR! maybe just another "file type" right? looking for the first 30 bytes of the whatsapp key

[lfcnassif]

Thanks @leosol, for sure!!! PRs for new configurations could also be done. Maybe a parser could also be implemented to extract the key from the parent container after it is carved. Or maybe CarverTask could be extended to allow skipping x bytes after the signature is found, not sure if this makes sense, usually the signature is part of the carved item.

[lfcnassif]

I think a simple AbstractCarver implementation could also be done to skip the signature.