Portable Elcomsoft Explorer For WhatsApp Forensic Edition 2.78.37223
Acquire and analyze WhatsApp communication histories from multiple sources. Extract WhatsApp databases from Android phones with and without root access, download WhatsApp backups from Google Drive and iCloud Drive or extract from local and cloud iOS system backups.
WhatsApp is one of the most popular instant messaging apps for mobile devices, not only due to its wide range of features but also due to the many operating systems it supports.
Since it is close to impossible to extract WhatsApp messages from a mobile phone, the only way to browse this information is to create a backup, then decrypt it using specialized tools, like Elcomsoft eXplorer for WhatsApp Portable.
Load WhatsApps archives from iCloud backups
Before getting to enjoy the functions of this application, you first need to take some time to install iCloud on your computer. You can enter your credentials right from the main window of the app so you can download your WhatsApp backups from iCloud and load them.
Alternatively, you can load WhatsApp logs from a local backup file, assuming you downloaded it from your iCloud account on a previous occasion.
Preview WhatsApp messages and attachments
As soon as the required data is loaded, you can proceed to the next step, that of exploring the contents of your WhatsApp archive.
Elcomsoft eXplorer for WhatsApp allows you to browse not only the text messages sent and received by you but also any attachments, such as videos or images. You can also review the phone numbers of the people you chatted with, as well as the exact dates and times.
Additionally, the utility makes it possible for you to restrict the number of shown messages by applying a date filter. You can also view only the incoming messages or the outgoing ones, or you can type a keyword and look for certain info within the logs.
WhatsApp Acquisition from Android
Elcomsoft Explorer for WhatsApp can extract WhatsApp conversations directly from a wide range of Android smartphones. As WhatsApp securely encrypts its databases, root access is recommended (but not required) for acquisition. If no root access is available,
Elcomsoft Explorer for WhatsApp will employ a workaround by pushing an acquisition tool into the phone temporarily for extracting the decryption key.
If root access is available, Elcomsoft Explorer for WhatsApp can extract WhatsApp conversations from Android handsets running Android 4.0 through 7.1.1. Without root access, compatibility is limited to Android versions 4.0 through 6.0.1.
WhatsApp Business for Android
WhatsApp Business extraction is supported for Android devices. Since WhatsApp Business is a separate app with a different security profile, Elcomsoft Explorer for WhatsApp requires root access to extract information directly from a physical Android handset. Logical acquisition (backup files) as well as cloud extraction from Google Drive are available without root access.
Downloading Proprietary WhatsApp Backups
WhatsApp has the ability to create cloud backups of its database, saving them in Apple iCloud Drive (iPhone) or Google Drive (Android phones). WhatsApp backups are unique per phone number. This means that the number of available WhatsApp backups in the user’s cloud account will depend on how many different phone numbers are used.
Information Available in WhatsApp Databases
WhatsApp is an instant messaging application. Its databases contain information about peer-to-peer communications between users, including the following records:
WhatsApp Database Content
Sent and received text messages complete with contact ID’s and timestamps
User’s contact database complete with phone numbers
Pictures and videos sent and received, complete with timestamps and contact ID’s
Viewing and Exporting
Elcomsoft Explorer for WhatsApp is equipped with a built-in viewer supporting multiple WhatsApp databases extracted from various sources. The viewer includes instant filtering and quick search functionality. Finding a certain contact, message or conversation is easy by specifying a date range or typing a partial key word into the search box.
fixed problem with WhatsApp database decryption