Elcomsoft Explorer for WhatsApp
Elcomsoft Explorer for WhatsAppAcquire and analyze WhatsApp communication histories from multiple sources. Extract WhatsApp databases from Android phones with and without root access, download WhatsApp backups from Google Drive and iCloud Drive or extract from local and cloud iOS system backups.
Download Free Trial Version
-
Includes WhatsApp acquisition and extraction tools for iOS and Android
-
Supports regular WhatsApp on Android and iOS and WhatsApp Business for Android
-
Comes with a built-in viewer
-
Extraction from physical devices, backups, Google and Apple cloud services
-
Automatic decryption, searching and filtering
-
All-in-one tool supplied with all relevant local and cloud acquisition tools
Supports: WhatsApp databases and backups, Android devices with and without root, iOS system backups (local and cloud), stand-alone WhatsApp backups (Google Drive, iCloud Drive)
Free EXWA Information Kit
Get first-hand information and articles to discover how EXWA decrypt and display WhatsApp communication histories
The Ultimate WhatsApp Acquisition Tool
Elcomsoft Explorer for WhatsApp (EXWA) is a Windows tool to acquire, decrypt and display WhatsApp communication histories. The tool offers multiple acquisition options to extract and decrypt WhatsApp data from multiple local and cloud sources including Android smartphones, iOS system backups (iTunes and iCloud), and WhatsApp proprietary cloud backups in Google Drive and iCloud Drive.
The tool supports both rooted and non-rooted Android phones. Encrypted backups can be automatically decrypted providing that the correct password is supplied. Downloading cloud backups from Apple iCloud and iCloud Drive requires entering the user’s Apple ID and password or using a binary authentication token extracted from the user’s computer, while Google Drive downloads require a login and a password. Two-factor authentication is supported for both Apple and Google accounts.
The built-in viewer offers convenient view of messages, calls and pictures stored in multiple WhatsApp databases obtained from the different sources. Instant filtering and ultra-fast searching allow finding records of interest in a matter of seconds.
WhatsApp Acquisition
Elcomsoft Explorer for WhatsApp supports all of the following acquisition methods of WhatsApp databases:
- Direct extraction from Android smartphones
Rooted (Android 4.0-9.0) and non-rooted (Android 4.0-6.0.1) devices are supported. Phone must be unlocked for acquisition. - Over-the-air acquisition of WhatsApp proprietary backups stored in Google Drive
WhatsApp backups can be pulled from the user’s Google Account and decrypted. Access to registered phone number or SIM card is required. Google ID and password required.[1] - Extraction from local iTunes backups
Encrypted backups are automatically decrypted. The correct password is required to decrypt the backup. - Over-the-air acquisition from iOS backups stored in Apple iCloud
WhatsApp databases are automatically retrieved from iOS backups stored in Apple iCloud. Fast acquisition is made possible by selectively downloading WhatsApp information instead of pulling the entire backup from the cloud. Apple ID and password or binary authentication token required.[2]. - Over-the-air acquisition of WhatsApp proprietary backups stored in iCloud Drive
Proprietary WhatsApp backups can be pulled from the user’s iCloud Drive account and decrypted. Access to registered phone number or SIM card is required. [1] Apple ID and password or binary authentication token required.[2]
WhatsApp Acquisition: Not an Easy Target
WhatsApp Messenger is one of the most popular instant messaging tools, if not the most popular one. WhatsApp clients are available for all mobile platforms including Android, Apple iOS, Blackberry, and Microsoft Windows Phone 8.x and Windows 10 Mobile.
WhatsApp is a popular target for spammers, hoaxers and cyber criminals. On at least one occasion, intercepted WhatsApp communications helped uncover a terrorist organization.
Since WhatsApp employs secure end-to-end messaging, it is not possible for law enforcement to request communication histories from Facebook who currently owns WhatsApp. As a result, acquisition is only possible from end-user devices or data backups produced by such devices and saved either locally or stored in a cloud.
Requirements to Download WhatsApp Databases from the Cloud
The Standard edition of Elcomsoft Explorer for WhatsApp can download information from Google Drive, Apple iCloud and iCloud Drive[1]. In order to be able to download information from Google Drive, Apple iCloud or iCloud Drive, the correct login and password are required. For Apple iCloud, one can use a binary authentication token extracted from the user’s PC or Mac. For extracting binary authentication tokens, we recommend using a tool from Elcomsoft Phone Breaker (if you don’t own a license, the evaluation version will work just fine). Decrypting the backup requires a one-time code received by an SMS to a registered phone number. [1] Without the code, the conversation database will remain encrypted; only the files (photos and videos) and contacts (Google Drive only) will be available.
- WhatsApp encrypts its cloud backups. In order to decrypt the backups, one-time access to the user’s registered phone number or SIM card is required. The decryption key is permanent, and can be used to decrypt existing and future backups created on iCloud Drive (for Google Drive, only existing ones). Alternatively, the encryption key can be obtained from jailbroken iPhones using Elcomsoft iOS Forensic Toolkit keychain extraction.
- Binary authentication tokens can be extracted from the user’s computer with a tool available with Elcomsoft Phone Breaker. If you don’t own the product, the token extraction tool is also available in the free evaluation version of Elcomsoft Phone Breaker.
Windows
- Windows 7 (32 bit)
- Windows 7 (64 bit)
- Windows 8
- Windows 8.1
- Windows 10
- Windows Server 2012/2016
Requirements to Download WhatsApp Databases from the Cloud
The Standard edition of Elcomsoft Explorer for WhatsApp can download information from Google Drive, Apple iCloud and iCloud Drive. In order to be able to download information from Apple iCloud/iCloud Drive, the correct Apple ID and password are required. Decrypting the backup requires a one-time code received by an SMS to a registered phone number. [1] Without the code, the conversation database will remain encrypted; only the files (photos and videos) and contacts (Google Drive only) will be available.
For Apple iCloud access, one can use a binary authentication token extracted from the user’s PC or Mac. For extracting binary authentication tokens, we recommend using a tool from Elcomsoft Phone Breaker (if you don’t own a license, the evaluation version will work just fine).
Trial limitations
10 records to view
- WhatsApp encrypts its cloud backups. In order to decrypt the backups, one-time access to the user’s registered phone number or SIM card is required. The decryption key is permanent, and can be used to decrypt existing and future backups created on iCloud Drive (for Google Drive, only existing ones). Alternatively, the encryption key can be obtained from jailbroken iPhones using Elcomsoft iOS Forensic Toolkit keychain extraction.
Latest Updates
Password Recovery and Data Decryption: Getting Around and About | Elcomsoft
Approaching iOS Extractions: Choosing the Right Acquisition Method | Elcomsoft
Cloud Forensics: Obtaining iCloud Backups, Media Files and Synchronized Data | Elcomsoft
iOS Forensic Toolkit 8.0 Now Official: Bootloader-Level Extraction for 76 Devices | Elcomsoft
Elcomsoft iOS Forensic Toolkit 7.60 extends agent-based full file system extraction
Low-Level Extraction of iOS 15.2-15.3.1 | Elcomsoft
Breaking Windows Passwords: LM, NTLM, DCC and Windows Hello PIN Compared | Elcomsoft
checkm8 Extraction: iPhone 7 | Elcomsoft
Apple TV 4K Keychain and Full File System Acquisition | Elcomsoft
Building an Efficient Password Recovery Workstation: Power Savings and Waste Heat Management | Elcomsoft
Apple Mobile Devices and iOS Acquisition Methods | Elcomsoft
Agent-based full file system and keychain extraction: now up to iOS 14.8 | Elcomsoft
Real-Time Surveillance via Apple iCloud | Elcomsoft
The Five Ways to Recover iPhone Deleted Data | Elcomsoft
iCloud Extractions Without Passwords and Tokens: When a Trusted Device is Enough | Elcomsoft
The iPhone Upgrade: How to Back Up and Restore iOS Devices Without Losing Data
LOGON is a pan-asian company operating in China, Hong Kong (HK), India, Singapore, Malaysia, Indonesia, Vietnam, Philippines and Thailand. LOGON has local dedicated trained product specialists in Hong Kong, Guangzhou, Kuala Lumpur, Mumbai and Bangalore. LOGON acts both as value added reseller and sole distributor for award winning software solutions. Customers can buy new licenses, purchase upgrades and renewals from any of our local offices. Contact us for first line support during evaluations, PoCs. We offer best practices consulting services and classroom & online training. Check our site for latest offers, special discounts, bundle deals, etc..
