Whatsapp - Desktop ...
 
Notifications
Clear all

Whatsapp - Desktop version

9 Posts
7 Users
0 Likes
5,100 Views
(@jfranck)
Posts: 20
Eminent Member
Topic starter
 

Whataspp has two alernatives for computers Whatsapp for Windows PC (desktop) or WhatsApp Web.
The messages are synced between the phone and the computer, and the messages can be seen on both devices.
Does anybody have analyzed any these alternatives?
Is it possible to recover any message?

 
Posted : 03/04/2017 8:19 am
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

Please install both the desktop and mobile versions of WhatsApp on your workstation and smartphone of choice.

Then send yourself, or friends messages, delete some messages.

Perform forensic collections of your workstation and smartphone to which you installed WhatsApp.

Identify the folders and files related to WhatsApp on both the workstation and smartphone.

Analyze those folders in your tool of choice.

Report to the forum what you found please.

 
Posted : 03/04/2017 8:51 am
(@jfranck)
Posts: 20
Eminent Member
Topic starter
 

Yes, that's the way to analyze. I have tried both versions quickly to see if I can find any storage of messages, but I couldn't find anything. I am looking for any clue to find a a recently dissapeared woman but I don't have time to go deeply in the analisys of these files.
Perhaps later I will analyze it deeply to be prepared for a future case.

If someone has experience with this applications I would thank any other comment.

 
Posted : 04/04/2017 12:44 am
UnallocatedClusters
(@unallocatedclusters)
Posts: 577
Honorable Member
 

jfranck,

Apologies to you in advance if you are in Law Enforcement - I may have incorrectly assumed you are a student studying forensics.

On a MacBook Pro running OSX 10.10.3, I was able to recover WhatsApp chat content from the following location

Users\<USER NAME>\Library\Mobile Documents\68Y0128N3~net~whatsapp~WhatsApp\Accounts\24985054571\backup\ChatSearch.sqlite (and ChatStorage.sqlite).

Within the ChatSearch.sqlite file, the "docs_content" table contains, amongst other information, the chat message content itself and the WhatsApp user ID which is in the form of "13126001234@s.whatsapp.net" (first digits are telephone number).

The contents of the WhatsApp sqlite databases were NOT encrypted and I could read the messages and other data simply by opening the sqlite database file in my SQLite database tools.

** If you are in fact Law Enforcement, please send me a private message and I will provide you with some additional help.

Regards,

Larry

 
Posted : 04/04/2017 1:43 am
(@dandaman_24)
Posts: 172
Estimable Member
 

Resurrecting an old thread.

Has anyone seen Whatsapp being used on a mobile phones browser, Whatsapp Web/Desktop ?

i.e. Handset A has shared the QR code with Handset B, enabling Handset B to send messages via Whatsapp Web/Desktop using Handset A's account.

This is a theory at present. If this is the case we only have Handset A to carryout our analysis. I notice that in PA it presents the Whatsapp messages with a mobile icon to show that the message was sent/received on a mobile device.

Anyone encountered a scenario similar to above ?

Thanks

 
Posted : 17/04/2018 7:13 am
(@rezaganjavi)
Posts: 1
New Member
 

@unallocatedclusters Larry your remarks were very helpful however, I find this folder : Users\\Library\Mobile Documents\

But it's empty. Also timemachine versions are empty.

My challenge is to at least get a list of chats from 600MB of files I have for whatsapp for mac -- without the android counterpart (uninstalled and reinstalled whatsapp on android forgetting I didn't have google backup enabled - so no backup - but in that 600 MB on mac consiting 300MB of cache and db's etc  (in various library whatsapp folder) the data had to be there. Would appreciate any tips.

 
Posted : 01/01/2022 9:31 pm
(@fgaiba)
Posts: 1
New Member
 

Have a good day everyone,

I find myself in the situation of a laptop from which I have to extract WhatsApp Desktop conversations, I wanted to know if it is possible, what tools I can possibly use and if it is sufficient to do Make a disk image with FTK and work on it.

Thank you all for the help

Felix

 
Posted : 24/10/2023 11:32 am
(@zunash)
Posts: 2
New Member
 

@fgaiba please share the solution

 
Posted : 03/01/2024 5:53 am
(@blogging-times)
Posts: 1
New Member
 

Posted by: @jfranck

Whataspp has two alernatives for computers Whatsapp for Windows PC (desktop) or WhatsApp Web.
The messages are synced between the phone and the computer, and the messages can be seen on both devices.
Does anybody have analyzed any these alternatives?
Is it possible to recover any message?

Yes, both alternatives, WhatsApp for Windows PC (desktop) and WhatsApp Web, offer the convenience of accessing your WhatsApp messages on your computer while keeping them synced with your phone. These options allow you to send and receive messages, view media, and engage in conversations seamlessly across devices.

Regarding message recovery, the process is similar for both WhatsApp for Windows PC and WhatsApp Web. Since messages are synced between your phone and the computer, you can recover messages using the backup feature provided by WhatsApp.

Here's a general overview of how you can recover messages:

1. **Backup:** WhatsApp automatically backs up your chat history to your phone's storage or cloud storage (Google Drive or iCloud for Android and iOS respectively) depending on your settings. You can also manually initiate a backup.

2. **Restore from Backup:** If you accidentally delete messages or conversations, you can restore them from the most recent backup. You'll need to uninstall and reinstall WhatsApp on your phone, and during the setup process, you'll be prompted to restore your chat history from the backup.

It's important to note that:

- You can only restore messages that were backed up prior to deletion.
- Messages received after the last backup won't be recoverable if they haven't been backed up yet.
- Restoring from a backup will replace your current chat history with the one from the backup, so any messages received after the backup will be lost.

If you're using WhatsApp Web, keep in mind that it mirrors your phone's WhatsApp interface, so any actions taken on the computer, such as deleting messages, will also affect your phone's WhatsApp.

For specific instructions on how to perform a backup and restore on your device, you can refer to WhatsApp's official documentation or help resources, as the process may vary slightly depending on your operating system (Android or iOS).

Overall, both WhatsApp for Windows PC and WhatsApp Web offer convenient ways to access and manage your WhatsApp messages on your computer, with the ability to recover messages using the backup feature provided by WhatsApp.

 

 
Posted : 18/03/2024 6:08 am
Share: