MOBILE FORENSICS

Forensic analysis of WhatsApp on Android

WhatsApp is one of the most frequently examined applications in mobile IT forensics. Messages, attachments, contacts and metadata can – depending on the available data – provide important technical information.

msgstore.db and other SQLite databases
wa.db
Media and attachment directories
Profile information
Local backups
Google Drive backups
Timestamps and metadata
Journal and WAL files

TECHNICAL BACKGROUND

Technical Fundamentals

WhatsApp stores information in various databases and directories.

Forensically relevant artefacts include, amongst others:

  • •msgstore.db and other SQLite databases
  • •wa.db
  • •Media and attachment directories
  • •Profile information
  • •Local backups
  • •Google Drive backups
  • •Timestamps and metadata
  • •Journal and WAL files

The layout may vary depending on the version of WhatsApp and Android.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, WhatsApp databases, media files and other artefacts are analysed using recognised IT forensic tools as well as manually. Timestamps, database entries and metadata are correlated with one another and fully documented.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔What news items are available?
  • ✔Which media files were sent or received?
  • ✔Is it technically possible to prove that content has been deleted?
  • ✔What time-related information is available?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Not every message or file can be reconstructed. End-to-end encryption, deletion processes, overwriting or missing data sources may limit the scope of the analysis. Technical findings are based solely on the available artefacts.

Forensic analysis of WhatsApp often provides key insights into communication and device usage. However, a reliable assessment requires a comprehensive analysis of all available data sources.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have WhatsApp data on an Android device examined by professionals? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Which databases are particularly relevant?
In particular, msgstore.db and wa.db, as well as their associated files.
Can deleted messages be recovered?
That depends on the data set and the artefacts available.
Are Google Drive backups useful?
Yes, provided they are lawfully available and may be used.
Are media outlets also being investigated?
Yes. Images, videos, documents and other attachments can form part of the analysis.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.