A Full WhatsApp Forensics Lab
One desktop tool takes you from a locked Android phone or iPhone to a court-ready report — extract, decrypt, read, analyse calls, trace live VOIP calls on a map, and export professional evidence. Here is exactly what each module does, shown on real screens.
ADB Data Extraction
Pull WhatsApp data straight from an Android device over USB cable or Wi-Fi (TCP/IP). Works on both rooted and non-rooted phones — including a dedicated non-root method for Android 13+ that uses a 64-digit end-to-end key. Grab the message database, the decryption key, contacts, or everything at once.
- USB & TCP/IP (Wi-Fi) modes
- Root & Non-Root extraction
- Android 13+ non-root (E2E key)
- msgstore.db, key file & contacts
ADB Extractor — connect over USB or Wi-Fi and pull msgstore.db, the key file, contacts or all files. (click to enlarge)
Database Decryption & Loading
WhatsApp stores everything in an encrypted database. Forensicator decrypts every format — .crypt12, .crypt14 and .crypt15 — using the device key file, then loads the decrypted msgstore.db together with the contacts database and the media folder so the whole case is ready to analyse.
- Crypt12 / 14 / 15 support
- Key-file based decryption
- Load contacts (wa.db)
- Attach the media folder
Decryptor — point it at the encrypted database and key, then load the decrypted data, contacts and media. (click to enlarge)
WhatsApp-Style Chat Viewer
Read recovered conversations in an interface identical to WhatsApp itself — no learning curve. Browse every chat, filter by Groups or Unread, jump to any date range, and see messages exactly as they originally appeared, including recovered deleted messages and per-contact message counts.
- Original WhatsApp look & feel
- Groups / Unread filters
- Date-range navigation
- Deleted-message recovery
Chat Viewer — the familiar WhatsApp layout with search, date filters and per-chat message counts. (click to enlarge)
Call Log Analysis
Get an instant breakdown of every WhatsApp call — total, incoming, outgoing, missed and video — backed by a complete log showing each number, duration, exact timestamp and call type. Filter by category and export the whole thing in a single click for your timeline.
- Incoming / Outgoing / Missed
- Voice & video call detection
- Duration & precise timestamps
- One-click export
Call Analysis — totals at a glance plus a full, filterable call log with durations and timestamps. (click to enlarge)
Live VOIP Analysis & Geolocation
Our flagship capability. A live network sniffer captures WhatsApp voice and video call endpoints in real time, resolves the ISP behind each server, and plots them on a live geolocation map. Investigators can watch call routing unfold as it happens — a level of insight standard forensic tools do not offer.
- Real-time UDP endpoint capture
- ISP identification
- Live geolocation map
- Exportable capture log
VOIP Analysis — captured call endpoints with ISP + location, mapped live while a call is active. (click to enlarge)
Forensic Export & Reports
Turn extracted evidence into court-ready documentation. Export chats to TXT, Excel, HTML or PDF in the original WhatsApp look, plus a dedicated call-log export. Perfect for case files, disclosure and evidence presentation.
- PDF & HTML (WhatsApp look)
- Excel & TXT chat export
- Dedicated call-log export
- Case-ready reports
Export — one click turns chats and call logs into TXT, Excel, HTML or PDF evidence. (click to enlarge)
Beyond Extraction — A Complete Intelligence Suite
Forensicator ships the deep analysis capabilities investigators expect from tools like Cellebrite and Oxygen — timeline reconstruction, entity intelligence, offline AI, and court-ready chain of custody — all in one Windows application.
Acquisition & Sources
- Android via ADB — USB & Wi-Fi (TCP/IP)
- Root & Non-Root (Android 13+ E2E key)
- iOS / iPhone import (iTunes / Finder backup)
- Google Drive cloud-backup extraction
- Media extraction & decryption
Forensic Intelligence
- Unified timeline (messages + calls + location)
- Communication network graph
- Keyword search + entity extraction
- Watchlist & threat-keyword scanning
- Analytics dashboard & charts
- Geolocation mapping
- Group analysis (admins & events)
- Deletion intelligence (behavioural patterns)
- Thumbnail recovery of deleted media
- Business intel — catalog, customers, orders, ads, automation
- WhatsApp ↔ Business database correlation
- Meta AI chats & viewed statuses
On-device AI
- Image OCR (multi-language) — runs fully offline, engine bundled
- Voice-note transcription (audio → text) — on the roadmap, not in this release
- Offline translation — on the roadmap, not in this release
- Designed to run on-device, so evidence never leaves the machine
Live VOIP Analysis
- Real-time UDP endpoint capture
- ISP identification + geolocation
- Remote peer detection (direct P2P)
- Network-quality live metrics
Case Management & Reporting
- Case management (ID, examiner)
- Tamper-evident chain of custody
- Court-ready forensic reports (PDF)
- Export: TXT / CSV / HTML / PDF / JSON
Messaging Recovery
- Full chat history (text, media, docs)
- Deleted-message recovery
- WhatsApp-style chat viewer
- Per-contact search & date filters
Complete Feature List
Every capability that ships with WhatsApp Forensicator v2.0 — 31 tools in a single Windows application.
Database Decryption
Decrypt Crypt12, Crypt14, and Crypt15 WhatsApp databases with ease.
Chat Viewer
View all chats with media, timestamps, and sender information.
Media Decryption
Decrypt and recover images, videos, and audio files.
VOIP Analysis
Analyze WhatsApp calls with detailed metadata.
Export Options
Export to TXT, CSV, HTML, JSON, and PDF formats.
Call Analysis
Detailed call logs with duration and timestamps.
Timeline Reconstruction
Reconstruct every message, call and media event into a single chronological forensic timeline.
Network Graph
Visualise contact relationships and communication patterns as an interactive network graph.
Deleted Message Recovery
Recover the actual text of “deleted for everyone” messages from surviving copies in the database.
Meta AI Chat Extraction
Extract and reconstruct hidden Meta AI conversations, prompts and AI-generated content.
iOS / iPhone Import
Import and analyse iPhone WhatsApp backups (ChatStorage.sqlite) — no root required.
Google Drive Import
Pull and decrypt WhatsApp cloud backups straight from Google Drive using the 64-digit key.
Chat Analytics
Message frequency, active hours, top contacts and behavioural statistics for every chat.
Location Map
Plot shared live and static locations on an interactive map with exact timestamps.
Group Analysis
Member lists, admin changes, join/leave events and full group-activity breakdown.
Keyword Intelligence
Flag threat, coercion, financial and other high-risk keywords across all conversations.
Deletion Intelligence
Behavioural analysis of deleted messages — bursts, timing patterns and who deletes what.
Viewed Status Recovery
Recover viewed statuses and their cached media before they expired.
Thumbnail Recovery
Recover embedded thumbnails of deleted media directly from the database.
Voice Transcription
Offline speech-to-text transcription of voice notes in multiple languages.
Image OCR
Extract text from images and screenshots offline, with multi-language support.
Offline Translation
Translate chats to English fully offline — evidence never leaves the machine.
Case Management
Court-ready case files with MD5/SHA-256/SHA-512 hashing and a tamper-evident audit trail.
Court Report
Generate a signed, 10-section chain-of-custody PDF report ready for legal submission.
WhatsApp / Business Correlation
Cross-link a personal and a WhatsApp Business database to find shared contacts and activity.
Business Profile
Extract WhatsApp Business profile, hours, category and verification details.
Business Catalog
Recover product catalogs, prices and item details from Business accounts.
Business Customers
Customer lists, labels and interaction history from WhatsApp Business.
Business Transactions
Order and payment/transaction records extracted from Business chats.
Business Ads
Click-to-WhatsApp ad journeys and lead sources from Business data.
Business Automation
Away messages, greetings and quick-reply automations recovered from Business accounts.
Evaluate Every Module Above Free for 7 Days
Approved law-enforcement agencies get the whole suite unlocked for 7 days to run a real case before purchasing. Individual and commercial users are not eligible — the paid plans cover them.
Requires agency registration plus an official authorisation letter, approved by our team — pick the “Law Enforcement Agency” option when registering.
Ready to run your first case?
Everything above ships in a single Windows application. Pick a plan and start extracting in minutes.
For authorised forensic & educational use only.