A New Tool for WhatsApp Acquisition

November 25th, 2015 by Vladimir Katalov

We have recently released a brand new product, Elcomsoft Explorer for WhatsApp. Targeted at home users and forensic experts along, this Windows-based, iOS-centric tool offers a bunch of extraction options for WhatsApp databases. Why the new tool, and how is it different from other extraction options offered by Elsomsoft’s mobile forensic tools? Before we move on to that, let’s have a look at the current state of WhatsApp.

What’s WhatsApp?

WhatsApp is one of the world’s most popular instant messengers. With more than 900 million active accounts, WhatsApp is the number one messenger in North America and parts of Europe. Recognizing its popularity, Facebook has paid $22 billion for the company.

WhatsApp has client apps on all popular mobile platforms including Android, iOS, Blackberry, the Nokia phones, Microsoft Windows Phone 8.x and Windows 10 Mobile, serving as an effective replacement for text and multimedia messaging and enabling true cross-platform communications on the go.

WhatsApp does not bill for each message sent or received. Other than the $1 yearly service fee, the cost of using WhatsApp is diminutive as the amount of Internet traffic it uses is very low.

WhatsApp is more secure than SMS, too. Unlike carrier-delivered text messages and MMS, WhatsApp communications cannot be intercepted or requested from the provider. Unlike Apple iMessages, WhatsApp is not tied to a single platform, serving as a perfect iMessage replacement for Android-iOS communications.

WhatsApp communication history is not reflected in the mobile service bill, and WhatsApp messages are not stored on carrier’s computers in case law enforcement officials need access to that information. WhatsApp messages fly directly between users’ devices, securely encrypted. Strict point-to-point messaging makes it impossible to intercept WhatsApp communications. Even breaking in to WhatsApp won’t help hackers steal someone’s communication history.

Due to its overwhelming popularity, WhatsApp quickly became a target for spammers, hoaxers and plain criminals of all kinds. The very fact that the messenger app is designed to use secure end-to-end communications makes it difficult for the police to investigate cases involving WhatsApp messaging. Since no logs are stored on carrier’s side, requesting WhatsApp history files from the mobile carrier or an Internet service provider is not possible. The only way to acquire WhatsApp histories is imaging end-user devices or pulling data from local or cloud backups. And that’s exactly what we do in Elcomsoft Explorer for WhatsApp.

Pulling WhatsApp Backups from the Cloud

We made Elcomsoft Explorer for WhatsApp to help legitimate WhatsApp users and mobile forensic experts access communication histories stored in the cloud or available in local iTunes backups. Elcomsoft Explorer for WhatsApp includes certain functionality from our dedicated mobile forensic tool, Elcomsoft Phone Breaker.

With Elcomsoft Explorer for WhatsApp, you can extract WhatsApp histories from the following sources:

  • Extract from local iTunes backups (iOS). If you have an offline iOS backup file sitting on your computer, or if you can make the phone produce a backup via iTunes, Elcomsoft Explorer for WhatsApp can extract WhatsApp communication history from that backup. Encrypted backups can be automatically decrypted if you know the password.
  • Download from Apple iCloud (iOS backups). If the option to make iCloud backups is activated on an iPhone, Elcomsoft Explorer for WhatsApp can connect to the user’s iCloud account and pull WhatsApp histories from iOS system backups. You won’t have to download the entire system backup, as Elcomsoft Explorer for WhatsApp will use selective access to only pull WhatsApp data. Apple ID and password are required. You can also use a binary authentication token (more on that later).
  • Download from iCloud Drive (WhatsApp standalone backups). Even if iCloud backups are not enabled, WhatsApp can be configured to back up its database into the cloud. In this case, WhatsApp will produce a standalone backup in a proprietary format. Elcomsoft Explorer for WhatsApp can download and parse that backup from iCloud Drive (as usual, with either the user’s Apple ID/password or binary authentication token).

Yes, iOS 9, Too

Elcomsoft Explorer for WhatsApp can download iOS backups saved by devices running iOS 9. There have been a big change in the way these backups are stored (Apple moved them from iCloud to iCloud Drive), so you will need to install iCloud for Windows in order to obtain these backups.

iCloud for Windows Is Required

Using Elcomsoft Explorer for WhatsApp for downloading iOS backups from iCloud or retrieving WhatsApp standalone backups from iCloud Drive requires installing Apple’s iCloud for Windows. You can download and install iCloud for Windows from Apple’s Web site.

Since WhatsApp instances are unique per telephone number, a single Apple account may contain multiple WhatsApp backups, each for its own telephone number. Elcomsoft Explorer for WhatsApp will list and allow downloading all of them.

A Word on Binary Authentication Tokens

Just like Elcomsoft Phone Breaker, Elcomsoft Explorer for WhatsApp can connect to iCloud with either the user’s Apple ID and password or by using a binary authentication token extracted from the user’s computer (PC or Mac). However, we didn’t include the tools to pull the token file from the computer (or disk image) with Elcomsoft Explorer for WhatsApp. If you need a tool to obtain the token, please install Elcomsoft Phone Breaker and use token extraction tool bundled with that product. No worries, you won’t have to pay to use that tool as it’s available in the free evaluation version of Elcomsoft Phone Breaker.

Viewing WhatsApp Databases

Elcomsoft Explorer for WhatsApp comes with a built-in viewer that allows you to browser through the multiple WhatsApp databases you’ve extracted. The viewer comes with instant searching and filtering, allowing you to locate contacts, messages and pictures of interest of filtering conversations matching a certain criteria – such as containing a certain key word or falling within a certain date range.

exwa_device

exwa_messages

exwa_media

Future Development

We are considering adding more features to Elcomsoft Explorer for WhatsApp to allow extracting WhatsApp histories from a wider range of devices. For now, the tool is limited to iOS, yet we want to add the ability to extract WhatsApp databases from Windows devices (Windows Phone 8.x and Windows 10 Mobile), BlackBerry backups and Android phones (via Google accounts). Stay tuned for more news!

Tags: , , , , ,

Sign up for free ElcomSoft Password Recovery Software newsletter

Leave a Reply

30 Comments on "A New Tool for WhatsApp Acquisition"

Notify of
avatar

PB
Guest
PB
8 months 29 days ago

Hi

Since the update of elcomsoft phone breaker we can no longer see all pictures sent through whatsapp. Will you update that or do we really need to buy this program as well?

Vladimir Katalov
Guest
Vladimir Katalov
8 months 23 days ago

PB,

We have found that in iOS 9 backups, some files (including some apps’ data) are encrypted the different way. The fix is on the way, EPB 5.10 will be released later this week!

suxever
Guest
suxever
8 months 17 days ago

This Can Also Recover Deleted Messages?
Many Thanks!

Vladimir Katalov
Guest
Vladimir Katalov
8 months 17 days ago

No yet, but we are working on that!

pb
Guest
pb
8 months 9 days ago

Thanks for the update Elcomsoft but it doesn’t seem to work very well at all unfortunately. Far from all pictures working and timestamp doesn’t work either.

Rodolfo
Guest
Rodolfo
7 months 22 days ago
Good morning! I´ve been trying to recover my files from iCloud due to stolen phone with the trial version of the Explorer for Whatsapp. Regarding that I´m facing some issues: Most of video files return the message: original file is not available in the backup. All the audios play only 3 to 5 seconds. Are these settings normal for the trial mode? If I buy the registration: Can I receive the full length files? Will it enable the Save option? If I buy The Phone Breaker, will I recover these corrupted and more files from the whatsapp history? In case… Read more »
PB
Guest
PB
7 months 20 days ago

Hi

One month later and social and communications still doesn’t work. Only get 4 pictures out of a thousand+. Iphone 6 ios version 9.2. Icloud backup

Cheers

pb
Guest
pb
6 months 27 days ago

I don’t know how I can describe it in more detail than I’m already doing. Iphone 6 ios version 9.2, backup downloaded with epb. Tried on my gf’s phone as well, which is an iphone 5s ios 9,2. Same problem there, whatsapp pictures doesn’t work and haven’t worked for several months.

Thanks

pb
Guest
pb
6 months 26 days ago

It works when downloading full backup and it also works with EXWA. Unfortunately my backup is too big to keep on my computer. I already have phone viewer and just renewed my license for epb and unfortunately can’t afford to buy exwa as well so would really appreciate if you could fix it for the epb.

Sorry for being annoying.

Andy
Guest
Andy
6 months 19 days ago

Viewing or downloading whatsapp videos doesnt work.
It show the tiny little thumbnail, but when you click on it it shows a red cross (not available).
Happends with 99% of accounts. Only account where it download also a “videos” folder.

Whats the problem here?

Paully
Guest
Paully
6 months 18 days ago

Same issue as Andy. Whatsapp iCloud Drive backups do not properly download videos. Thumbnails will appear as if file is available but will not let you play or save. Red play button appears with an error that the file was moved from its original location. Pictures works fine.

Krem
Guest
Krem
6 months 14 days ago

Same problem as Andy and Paully. Whatsapp icloud drive backup has downloaded pictures, audio files and videos. However unable to play videos it’s shows the thumbnail but red button appears with an error that the file was moved from its original location.

Andy
Guest
Andy
6 months 12 days ago

Videos still doesnt work. New Version didnt change anything. Did you even tested the programm? Then you would have noted that downloading videos is not possible.

Also, i have a 1gb backup. Opening the media folder took me 35 minutes!!!!

Chris
Guest
Chris
6 months 5 days ago

same to me, update didnt change anything.

Videos not included in backup, opening media folder takes hours

please
Guest
please
5 months 23 days ago

When came this for android to?for googledrive

please
Guest
please
5 months 23 days ago

Cme this for andriod?

Vladimir Katalov
Guest
Vladimir Katalov
5 months 21 days ago

For now it is for iOS only, but Android support is on the way!

please
Guest
please
5 months 21 days ago

I KNOW :(That’s good to hear. I’m looking forward. There is also a large group . You are great keep it up 🙂

Christian
Guest
Christian
5 months 20 days ago

When does this software supports video??? I bough it but its useless now if it doesnt download video files. Fix it!!!

Vladimir Katalov
Guest
Vladimir Katalov
5 months 20 days ago

Christian,

It does. The videos are now always included into backup (but only thumbnails). If you are sure that videos are there, please contact our support team with the details, including WhatsApp version, and what type of backup (local, iCLoud or iCloud Drive) you are working with.

Christian
Guest
Christian
5 months 20 days ago

The videos are NOT included. Only thumbnails. Thumbnails are NOT the videos. I wanne see the Videos, not just small pics of the videos!!

Dietmar
Guest
Dietmar
5 months 19 days ago

Hello that a fine Tool give that for googledrive(andriod clouds)too ?

sham
Guest
sham
5 months 9 hours ago

Hello,

I need key for Elcomsoft explorer for whatsapp 1.10. Please help.

wpDiscuz