WhatsApp has the option to download a Windows (or Mac) Desktop version. Installation requires pairing the software with a mobile phone.

I have read a similar question about Android devices, and according to this answer, in my case, the Desktop PC would be considered a Secondary Device.

My question is: Which forensic tools and/or methods are available to extract WhatsApp data from a Secondary Device (Desktop PC) when there isn’t any “first device” (i.e. the original mobile device) to extract it from?

Does the Desktop version of Whatsapp store any data (i.e. chats, media files, etc.) on the Desktop machine, and are there any forensics tools or methods to extract such data?

  • check here C:\Users[User_Name]\AppData\Roaming\WhatsApp\Cache – Vipul Nair Aug 17 '19 at 20:32
  • I see files such as data_3, data_2. What format are these files? – Michael Haephrati Aug 17 '19 at 20:40
  • I actually haven't tried it.Copy pasted from quora.Its probably encrypted.Whatsapp data on the phone is encrypted as well. – Vipul Nair Aug 17 '19 at 20:59
  • Those are sqli database files. WhatsApp doesn't encrypt the data at rest, neither on phone nor on paired desktops. Signalapp does. – defalt Aug 17 '19 at 21:06
  • 1
    @defalt I wouldn't consider this a request for a product, but more generally about how – schroeder Aug 18 '19 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.