IPED x PA - Specific Situation When Decoding WhatsApp Image attachment forwarded

[gisms]

I was comparing a situation between a WhatsApp decoded by PA Cellebrite and another by iped's internal parser.
The situation was as follows:

• An image file (image_X) was received and downloaded in chat_A via Whatsapp on the device.

• This same image_X was then forwarded, via WhatsApp Web, to a chat_B. In chat_B's view, on the device, it was not downloaded, leaving only the thumbnail.

Result:

• The IPED parser reassembled chat_B by linking the original image_x as the forwarded attachment and not just the thumb. PA only linked the thumbnail (it does not open the original).

Would this difference be possible because IPED works using the hash256 of the attachments to make the link, whereas PA does not?
Maybe PA uses other information, such as file_path(message_media table), for decoding, I don't know. Just a curiosity that I would like to understand.

[lfcnassif]

I think your conclusions are correct.

[gisms]

In the future I will ask cellebrite about it, at least I already have a path of understanding, thank you very much

[lfcnassif]

At least they will have to compute sha-256 of all multimedia files, and that will make PA processing longer than it is today.

[gisms]

Holy Mary kkkkkk