Retrieving WhatsApp...
 
Notifications
Clear all

Retrieving WhatsApp messages (inactive account) from iCloud

1 Posts
1 Users
0 Reactions
784 Views
(@jefferson-macedo)
Active Member
Joined: 5 months ago
Posts: 3
Topic starter  

Hi, Dear,

I have a particular situation where the WhatsApp account from an iPhone 12 Pro, owned by a custodian, was deleted (probably someone went through: WhatsApp > Settings > Account > Delete my account). I tried to use UFED and even Belkasoft, but neither of them retrieved WhatsApp messages from the device since the account was deleted.

Whenever I try to open WhatsApp on the target iPhone, it only shows an option to update the WhatsApp version, and if I add the target phone number to my personal WhatsApp account, it says, "The phone is not on WhatsApp. Invite to WhatsApp."

On the other hand, looking at the iCloud storage in the iPhone (Settings > iCloud > Manage Storage), I see that there are more than 17 GB of WhatsApp data there. See: https://drive.google.com/file/d/1OAUSNzY-p9engK0k5e_SxSUk6DnqNMZO/view?usp=sharing .

Questions:

1) Is it correct to say and be 100% sure that WhatsApp messages are preserved in iCloud regardless of the WhatsApp account status (inactive) on the iPhone?

 

2) If I configure a new iPhone using the current custodian's iCloud credentials, will the previous iPhone be automatically disabled or damaged?

 

3) Do you know of any forensic tools, other than Cellebrite or Belkasoft, that would allow me to download and restore WhatsApp messages from the target iCloud? Any other open-source or low-cost tools would be appreciated.

Thank you!


   
Quote
Share: