Elcomsoft Explorer for WhatsApp (EXWA) is a Windows tool to access, decrypt and view WhatsApp communication histories. The tool offers multiple acquisition options to extract and decrypt WhatsApp data from various local and cloud sources, including Android smartphones, iOS system backups (iTunes and iCloud), and WhatsApp’s own cloud backups in Google Drive and iCloud Drive.
The tool supports both rooted and non-rooted Android phones. Encrypted backups can be automatically decrypted as long as the correct password is provided. Downloading cloud backups from Apple iCloud and iCloud Drive requires entering the user’s Apple ID and password or using a binary authentication token obtained from the user’s computer, while downloading from Google Drive requires a name username and password required. Two-factor authentication is supported for Apple and Google accounts.
The built-in viewer provides a convenient overview of messages, calls and photos stored in various WhatsApp databases received from various sources. Instant filtering and ultra-fast searching let you find interesting records in seconds.
get whatsapp
Elcomsoft Explorer for WhatsApp supports all the following methods to access WhatsApp databases:
Direct extraction from Android smartphones
Rooted (Android) and non-rooted (Android) devices are supported. Phone must be unlocked to purchase.
Wirelessly access your own WhatsApp backup stored on Google Drive
WhatsApp backup can be downloaded and decrypted from the user’s Google account. Access to a registered phone number or SIM card is required. Google ID and password are required.
Restore from local iTunes backup
Encrypted backups are automatically decrypted. The correct password is required to decrypt the file.
Wireless access from iOS backups stored in Apple iCloud
WhatsApp databases are automatically recovered from iOS backups stored in Apple iCloud. Fast retrieval is possible by selectively downloading information from WhatsApp instead of downloading the full backup from the cloud. Apple ID and password or binary authentication token required.
Wireless access to your own WhatsApp backup stored in iCloud Drive
Own WhatsApp backups can be downloaded from the user’s iCloud Drive account and can be decrypted. Access to a registered phone number or SIM card is required. Apple ID and password or binary authentication token required.
Acquisition of WhatsApp: not an easy goal
WhatsApp Messenger is one of the most popular instant messaging tools, if not the most popular. WhatsApp clients are available for all mobile platforms including Android, Apple iOS, Blackberry and Microsoft Windows Phone and Windows 10 Mobile.
WhatsApp is a popular target for spammers, scammers and cybercriminals. In at least one case, intercepted WhatsApp messages helped uncover a terrorist organization.
Because WhatsApp uses secure end-to-end messaging, law enforcement cannot request a communication history from the current owner of WhatsApp. As a result, retrieval is only possible from end-user devices or data backups created from such devices and stored locally or in the cloud.
