
This puts us back to the root/no root situation, as sandbox access is only possible if you have superuser permissions. To decrypt that database, you will need the encryption key that is stored in WhatsApp sandbox. Encrypted WhatsApp backups have file names ending with. WhatsApp can also create a standalone backup to Android shared storage or an SD card, but such backups are always encrypted. In other words, if you are acquiring a reasonably new Android handset, it’s not very likely that you’ll be able to pull this trick (at least for the time being). Android 7.0 and newer make things much more complex we are still looking forward to implement a similar approach for more recent Android builds. We can do it with EXWA, but only on older versions of Android from Android 4.0 through 6.0.1. The only way to access a WhatsApp database on non-rooted devices requires sideloading a special version of WhatsApp and forcing it to return the original, unencrypted database to the host.

The database is excluded from ADB backups, and can only be accessed if the device is rooted. On Android smartphones, WhatsApp keeps its chat database in a sandbox. Let’s review WhatApp recovery/decryption options for both Android and iOS, and see what is new in Elcomsoft eXplorer for WhatsApp (EXWA). It is important to note that WhatsApp accounts cannot be used on more than one device. In other words, any message that passes through WhatsApp servers is immediately deleted once it’s delivered (and it would be of no use to forensic experts anyway due to end-to-end encryption). All it has is a messaging relay service, which does not store messages for any longer than required to pass them along. WhatsApp does not have its own native cloud service such as Telegram. The other option is going through the cloud. The first option is capturing the message database directly from the device of either party. Once an expert accepts to access the suspect’s WhatsApp communication history, they will struggle with the encryption and demand for a vendor-provided backdoor ( WhatsApp: The Bad Guys’ Secret Weapon).Īre there any other options to access WhatsApp conversations? We know of at least two.

While this is great news to consumers and privacy advocates, it is also bad news for the law enforcement.

WhatsApp is secure thanks to end-to-end encryption to make intercepted messages impossible to decrypt. With more than 1.5 billion users and about half billion daily active users, WhatsApp sends over 100 billion messages per day. WhatsApp remains one of the most popular instant messengers.
