WhatsApp Forensics: The Complete Guide (2026)

WhatsApp forensics is the lawful acquisition, decryption and analysis of WhatsApp data — messages, calls, media and metadata — from a phone or its backups, done in a way that preserves the evidence's integrity so it can stand up in an investigation or in court. In practice that means four stages: acquiring the encrypted database from an Android or iOS device, decrypting it with the right key material, analysing the decrypted records, and documenting every step in a defensible chain of custody. This guide walks through each stage, what is genuinely possible (including for deleted messages), and what it takes for the results to survive scrutiny.

First: only with authorization

Before any technique — WhatsApp forensics is for devices you own or are legally authorised to examine: a warrant, written consent, or an organisational mandate. Examining someone's phone without authority is illegal in most jurisdictions, and evidence gathered that way is worthless in court anyway. Every reputable tool, ours included, is built and licensed for authorised use.

Where WhatsApp keeps its data

On Android, WhatsApp stores messages in an SQLite database called msgstore.db, contacts in wa.db, and media as files (with transit copies encrypted as .enc). At rest, backups of the message database are encrypted as msgstore.db.crypt12, .crypt14 or .crypt15 depending on the WhatsApp version — crypt15 is the current end-to-end-encrypted backup format, keyed by a 64-digit key generated on the device. On iPhone, the equivalent records live in ChatStorage.sqlite inside the app container, reachable through an iTunes/Finder-style backup.

Stage 1 — Acquisition

Android, with root

On a rooted device the examiner can pull msgstore.db, the key file and wa.db directly from /data/data/com.whatsapp/ over ADB. This works on every Android version and yields the key file needed for crypt12/14 decryption.

Android, without root

Two non-root paths exist. On Android 13 and earlier, the legacy-backup technique (installing an older WhatsApp build and using adb backup) can extract the database and key without root. On Android 14 and newer that trick is dead — but WhatsApp's own backup, msgstore.db.crypt15, lives in the shared media area (/sdcard/Android/media/com.whatsapp/) and can be pulled with plain ADB. Decrypting it then requires the user's 64-digit end-to-end backup key, so this path depends on lawful access to that key.

iPhone

No jailbreak is required: WhatsApp and WhatsApp Business data ride inside the standard device backup. An examiner can import an existing iTunes / Finder / Apple Devices backup (encrypted backups included, with the password) or create a fresh backup over USB. This works across modern iOS versions, iOS 12 through iOS 26.

Cloud

Google Drive WhatsApp backups can also be retrieved and decrypted through the crypt15 path — with the account credentials and the 64-digit key, i.e. with the account owner's authority.

Stage 2 — Decryption

crypt12 and crypt14 use AES-GCM with a key held in the app's private key file, so they decrypt when you have that file (root or legacy extraction). crypt15 derives its AES key from the 64-digit backup key via HKDF-SHA256; there is no key file, so the 64-digit key is the only door. A correct implementation validates its output — a real SQLite database — rather than declaring success on garbage: a wrong key must fail loudly, never produce a plausible-looking fake.

Stage 3 — Analysis

Once decrypted, msgstore.db yields chats, calls, group membership, shared locations and rich metadata. Serious analysis goes beyond reading messages: a unified timeline across messages, calls and locations; a communication graph of who talks to whom (with group chats kept visually and analytically distinct from individuals); entity extraction for phone numbers, emails and crypto/UPI addresses; local voice-note transcription and image OCR; and WhatsApp Business artefacts such as catalogues, orders and customer labels.

Can deleted messages be recovered? An honest answer

Sometimes — and only when the data still exists. A "delete for everyone" leaves a tombstone record; the original text is recoverable only where a copy survives, for example inside a quoted reply or in an older backup. Database pages that have been vacuumed are gone. Any tool that promises to recover every deleted message is overpromising. A forensic report must distinguish "this message was deleted" (provable from the tombstone) from "this is what it said" (provable only with a surviving copy).

Stage 4 — Court-ready evidence

Technique gets you data; discipline gets it admitted. The essentials:

• Never modify the evidence. Analysis must open acquired databases read-only — even an innocent write-capable connection can alter a WAL-mode SQLite file's bytes and break its hash.
• Hash everything. SHA-256 every acquired file at acquisition, and verify again before reporting.
• Keep a tamper-evident audit trail of every action, ideally witnessed by an independent system (server-side notarisation), so the record does not rest on the examiner's own machine alone.
• Report honestly: state what was acquired and how, what could and could not be verified, and the limits of each technique.

In India, electronic records additionally need a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (the successor to Section 65B of the Evidence Act) covering the device and process that produced them. Similar authenticity requirements exist in most jurisdictions — build the documentation as you work, not after the fact.

Tooling

Everything above can be assembled from separate pieces — ADB, backup extractors, SQLite browsers — or done in one guided workflow. WhatsApp Forensicator packages acquisition (Android root and non-root, iPhone, Google Drive), crypt12/14/15 decryption, analysis and court-ready reporting with hashing and chain-of-custody built in, and processes everything locally on the examiner's machine. See plans or the FAQ for licensing details.

This guide is for lawful forensic use. Always operate under proper authorisation and your jurisdiction's rules of evidence.