ElcomSoft blog

«…Everything you wanted to know about password recovery, data decryption,
mobile & cloud forensics…»

A New Tool for WhatsApp Acquisition

November 25th, 2015 by Vladimir Katalov

We have recently released a brand new product, Elcomsoft Explorer for WhatsApp. Targeted at home users and forensic experts along, this Windows-based, iOS-centric tool offers a bunch of extraction options for WhatsApp databases. Why the new tool, and how is it different from other extraction options offered by Elsomsoft’s mobile forensic tools? Before we move on to that, let’s have a look at the current state of WhatsApp.

What’s WhatsApp?

WhatsApp is one of the world’s most popular instant messengers. With more than 900 million active accounts, WhatsApp is the number one messenger in North America and parts of Europe. Recognizing its popularity, Facebook has paid $22 billion for the company.

WhatsApp has client apps on all popular mobile platforms including Android, iOS, Blackberry, the Nokia phones, Microsoft Windows Phone 8.x and Windows 10 Mobile, serving as an effective replacement for text and multimedia messaging and enabling true cross-platform communications on the go.

WhatsApp does not bill for each message sent or received. Other than the $1 yearly service fee, the cost of using WhatsApp is diminutive as the amount of Internet traffic it uses is very low.

WhatsApp is more secure than SMS, too. Unlike carrier-delivered text messages and MMS, WhatsApp communications cannot be intercepted or requested from the provider. Unlike Apple iMessages, WhatsApp is not tied to a single platform, serving as a perfect iMessage replacement for Android-iOS communications.

WhatsApp communication history is not reflected in the mobile service bill, and WhatsApp messages are not stored on carrier’s computers in case law enforcement officials need access to that information. WhatsApp messages fly directly between users’ devices, securely encrypted. Strict point-to-point messaging makes it impossible to intercept WhatsApp communications. Even breaking in to WhatsApp won’t help hackers steal someone’s communication history.

Due to its overwhelming popularity, WhatsApp quickly became a target for spammers, hoaxers and plain criminals of all kinds. The very fact that the messenger app is designed to use secure end-to-end communications makes it difficult for the police to investigate cases involving WhatsApp messaging. Since no logs are stored on carrier’s side, requesting WhatsApp history files from the mobile carrier or an Internet service provider is not possible. The only way to acquire WhatsApp histories is imaging end-user devices or pulling data from local or cloud backups. And that’s exactly what we do in Elcomsoft Explorer for WhatsApp.

Pulling WhatsApp Backups from the Cloud

We made Elcomsoft Explorer for WhatsApp to help legitimate WhatsApp users and mobile forensic experts access communication histories stored in the cloud or available in local iTunes backups. Elcomsoft Explorer for WhatsApp includes certain functionality from our dedicated mobile forensic tool, Elcomsoft Phone Breaker.

With Elcomsoft Explorer for WhatsApp, you can extract WhatsApp histories from the following sources:

  • Extract from local iTunes backups (iOS). If you have an offline iOS backup file sitting on your computer, or if you can make the phone produce a backup via iTunes, Elcomsoft Explorer for WhatsApp can extract WhatsApp communication history from that backup. Encrypted backups can be automatically decrypted if you know the password.
  • Download from Apple iCloud (iOS backups). If the option to make iCloud backups is activated on an iPhone, Elcomsoft Explorer for WhatsApp can connect to the user’s iCloud account and pull WhatsApp histories from iOS system backups. You won’t have to download the entire system backup, as Elcomsoft Explorer for WhatsApp will use selective access to only pull WhatsApp data. Apple ID and password are required. You can also use a binary authentication token (more on that later).
  • Download from iCloud Drive (WhatsApp standalone backups). Even if iCloud backups are not enabled, WhatsApp can be configured to back up its database into the cloud. In this case, WhatsApp will produce a standalone backup in a proprietary format. Elcomsoft Explorer for WhatsApp can download and parse that backup from iCloud Drive (as usual, with either the user’s Apple ID/password or binary authentication token).

Yes, iOS 9, Too

Elcomsoft Explorer for WhatsApp can download iOS backups saved by devices running iOS 9. There have been a big change in the way these backups are stored (Apple moved them from iCloud to iCloud Drive), so you will need to install iCloud for Windows in order to obtain these backups.

iCloud for Windows Is Required

Using Elcomsoft Explorer for WhatsApp for downloading iOS backups from iCloud or retrieving WhatsApp standalone backups from iCloud Drive requires installing Apple’s iCloud for Windows. You can download and install iCloud for Windows from Apple’s Web site.

Since WhatsApp instances are unique per telephone number, a single Apple account may contain multiple WhatsApp backups, each for its own telephone number. Elcomsoft Explorer for WhatsApp will list and allow downloading all of them.

A Word on Binary Authentication Tokens

Just like Elcomsoft Phone Breaker, Elcomsoft Explorer for WhatsApp can connect to iCloud with either the user’s Apple ID and password or by using a binary authentication token extracted from the user’s computer (PC or Mac). However, we didn’t include the tools to pull the token file from the computer (or disk image) with Elcomsoft Explorer for WhatsApp. If you need a tool to obtain the token, please install Elcomsoft Phone Breaker and use token extraction tool bundled with that product. No worries, you won’t have to pay to use that tool as it’s available in the free evaluation version of Elcomsoft Phone Breaker.

Viewing WhatsApp Databases

Elcomsoft Explorer for WhatsApp comes with a built-in viewer that allows you to browser through the multiple WhatsApp databases you’ve extracted. The viewer comes with instant searching and filtering, allowing you to locate contacts, messages and pictures of interest of filtering conversations matching a certain criteria – such as containing a certain key word or falling within a certain date range.




Future Development

We are considering adding more features to Elcomsoft Explorer for WhatsApp to allow extracting WhatsApp histories from a wider range of devices. For now, the tool is limited to iOS, yet we want to add the ability to extract WhatsApp databases from Windows devices (Windows Phone 8.x and Windows 10 Mobile), BlackBerry backups and Android phones (via Google accounts). Stay tuned for more news!


Tags: , , , , ,

Sign up for free ElcomSoft Password Recovery Software newsletter

31 Responses to “A New Tool for WhatsApp Acquisition”

  1. PB says:


    Since the update of elcomsoft phone breaker we can no longer see all pictures sent through whatsapp. Will you update that or do we really need to buy this program as well?

  2. Vladimir Katalov says:


    We have found that in iOS 9 backups, some files (including some apps’ data) are encrypted the different way. The fix is on the way, EPB 5.10 will be released later this week!

  3. suxever says:

    This Can Also Recover Deleted Messages?
    Many Thanks!

  4. Vladimir Katalov says:

    No yet, but we are working on that!

  5. pb says:

    Thanks for the update Elcomsoft but it doesn’t seem to work very well at all unfortunately. Far from all pictures working and timestamp doesn’t work either.

    • pb,

      Please create the ticket in our online support system, including as much details as possible, including the iOS version, and what backup source are you working with (local iTunes backup, iCloud backup or iCloud Drive). We will do our best to locate and fix the problem you have encountered!

  6. Rodolfo says:

    Good morning!

    I´ve been trying to recover my files from iCloud due to stolen phone with the trial version of the Explorer for Whatsapp.

    Regarding that I´m facing some issues:

    Most of video files return the message: original file is not available in the backup.

    All the audios play only 3 to 5 seconds.

    Are these settings normal for the trial mode?

    If I buy the registration:

    Can I receive the full length files?

    Will it enable the Save option?

    If I buy The Phone Breaker, will I recover these corrupted and more files from the whatsapp history?

    In case I buy the Phone breaker and noticied the Explorer for Whatsapp is mor accute, can I change the subscription without another payment?

    Thank you very much indeed.

  7. PB says:


    One month later and social and communications still doesn’t work. Only get 4 pictures out of a thousand+. Iphone 6 ios version 9.2. Icloud backup


  8. pb says:

    I don’t know how I can describe it in more detail than I’m already doing. Iphone 6 ios version 9.2, backup downloaded with epb. Tried on my gf’s phone as well, which is an iphone 5s ios 9,2. Same problem there, whatsapp pictures doesn’t work and haven’t worked for several months.


  9. pb,

    Could you please try to download FULL device backup with EPB (not just “Social & communications” category), or use the EXWA instead? Also, what is the WhatsApp version?

  10. pb says:

    It works when downloading full backup and it also works with EXWA. Unfortunately my backup is too big to keep on my computer. I already have phone viewer and just renewed my license for epb and unfortunately can’t afford to buy exwa as well so would really appreciate if you could fix it for the epb.

    Sorry for being annoying.

  11. Andy says:

    Viewing or downloading whatsapp videos doesnt work.
    It show the tiny little thumbnail, but when you click on it it shows a red cross (not available).
    Happends with 99% of accounts. Only account where it download also a “videos” folder.

    Whats the problem here?

  12. Paully says:

    Same issue as Andy. Whatsapp iCloud Drive backups do not properly download videos. Thumbnails will appear as if file is available but will not let you play or save. Red play button appears with an error that the file was moved from its original location. Pictures works fine.

  13. Krem says:

    Same problem as Andy and Paully. Whatsapp icloud drive backup has downloaded pictures, audio files and videos. However unable to play videos it’s shows the thumbnail but red button appears with an error that the file was moved from its original location.

  14. Andy says:

    Videos still doesnt work. New Version didnt change anything. Did you even tested the programm? Then you would have noted that downloading videos is not possible.

    Also, i have a 1gb backup. Opening the media folder took me 35 minutes!!!!

    • Andy,

      We test the product carefully with all available versions of iOS and WhatsApp. But please create the ticket in our support system; we need to get some technical details from you.

  15. Chris says:

    same to me, update didnt change anything.

    Videos not included in backup, opening media folder takes hours

  16. please says:

    When came this for android to?for googledrive

  17. please says:

    Cme this for andriod?

  18. Vladimir Katalov says:

    For now it is for iOS only, but Android support is on the way!

  19. please says:

    I KNOW :(That’s good to hear. I’m looking forward. There is also a large group . You are great keep it up 🙂

  20. Christian says:

    When does this software supports video??? I bough it but its useless now if it doesnt download video files. Fix it!!!

  21. Vladimir Katalov says:


    It does. The videos are now always included into backup (but only thumbnails). If you are sure that videos are there, please contact our support team with the details, including WhatsApp version, and what type of backup (local, iCLoud or iCloud Drive) you are working with.

  22. Christian says:

    The videos are NOT included. Only thumbnails. Thumbnails are NOT the videos. I wanne see the Videos, not just small pics of the videos!!

    • Christian,

      I mean that the videos are simply NOT in backup. There is an option in WhatsApp to include videos, and if disabled, the files are simply not there — so there is no possibility to show them.

  23. Dietmar says:

    Hello that a fine Tool give that for googledrive(andriod clouds)too ?

  24. sham says:


    I need key for Elcomsoft explorer for whatsapp 1.10. Please help.

  25. J H says:

    any update on the new encryption that whatsapp employeed on the icloudDrive backups?

    I had a quick look – seems like the first 64 bytes(?) of the chatstorage.sqlite.enc is the IV. Just can’t figure out where the Key is cominging from, unless its one of the entries in the group.net.whatsapp.WhatsApp.shred.plist

    I’m assuming they employed something like the crypt12 encryption they use on Android here as well…