Elcomsoft Explorer for WhatsApp

Acquire and analyze WhatsApp communication histories from multiple sources. Extract WhatsApp databases from Android phones with and without root access, download WhatsApp backups from iCloud Drive or extract from local and cloud iOS system backups.

  • Includes WhatsApp acquisition and extraction tools for iOS and Android
  • Comes with a built-in viewer
  • Automatic decryption, searching and filtering
  • All-in-one tool supplied with all relevant local and cloud acquisition tools

Supports: WhatsApp databases and backups, Android devices with and without root, iOS system backups (local and cloud), stand-alone WhatsApp backups (iCloud Drive)

Standard Edition $ 79
Buy now

The Ultimate WhatsApp Acquisition Tool

Elcomsoft Explorer for WhatsApp (EXWA) is a Windows tool to acquire, decrypt and display WhatsApp communication histories. The tool provides multiple acquisition options to extract and decrypt WhatsApp data from multiple local and cloud sources including Android smartphones, iOS system backups (iTunes and iCloud), and WhatsApp proprietary cloud backups in iCloud Drive.

The tool supports both rooted and non-rooted Android phones. Encrypted backups can be automatically decrypted providing that the correct password is supplied. Downloading cloud backups from Apple iCloud and iCloud Drive requires entering the user’s Apple ID and password or using a binary authentication token extracted from the user’s computer.

The built-in viewer offers convenient view of messages, calls and pictures stored in multiple WhatsApp databases obtained from the different sources. Instant filtering and ultra-fast searching allow finding records of interest in a matter of seconds.

WhatsApp Acquisition

Elcomsoft Explorer for WhatsApp supports all of the following acquisition methods of WhatsApp databases:

  • Direct extraction from Android smartphones
    Rooted (Android 4.0-7.1.1) and non-rooted (Android 4.0-6.0.1) devices are supported. Phone must be unlocked for acquisition.
  • Extraction from local iTunes backups
    Encrypted backups are automatically decrypted. The correct password is required to decrypt the backup.
  • Over-the-air acquisition from iOS backups stored in Apple iCloud
    WhatsApp databases are automatically retrieved from iOS backups stored in Apple iCloud. Fast acquisition is made possible by selectively downloading WhatsApp information instead of pulling the entire backup from the cloud.[1] Apple ID and password or binary authentication token required.[2].
  • Over-the-air acquisition of WhatsApp proprietary backups stored in iCloud Drive
    Proprietary WhatsApp backups can be pulled from the user’s iCloud Drive account and decrypted. Access to registered phone number or SIM card is required. [1] Apple ID and password or binary authentication token required.[2]

WhatsApp Acquisition: Not an Easy Target

WhatsApp Messenger is one of the most popular instant messaging tools, if not the most popular one. WhatsApp clients are available for all mobile platforms including Android, Apple iOS, Blackberry, and Microsoft Windows Phone 8.x and Windows 10 Mobile.

WhatsApp is a popular target for spammers, hoaxers and cyber criminals. On at least one occasion, intercepted WhatsApp communications helped uncover a terrorist organization.

Since WhatsApp employs secure end-to-end messaging, it is not possible for law enforcement to request communication histories from Facebook who currently owns WhatsApp. As a result, acquisition is only possible from end-user devices or data backups produced by such devices and saved either locally or stored in a cloud.

Requirements to Download WhatsApp Databases from the Cloud

The Standard edition of Elcomsoft Explorer for WhatsApp can download information from Apple iCloud and iCloud Drive[1]. In order to be able to download information from Apple iCloud/iCloud Drive, the correct Apple ID and password are required. In addition, one can use a binary authentication token extracted from the user’s PC or Mac. For extracting binary authentication tokens, we recommend using a tool from Elcomsoft Phone Breaker (if you don’t own a license, the evaluation version will work just fine).


  1. WhatsApp encrypts its cloud backups. In order to decrypt the backups, one-time access to the user’s registered phone number or SIM card is required. The decryption key is permanent, and can be used to decrypt existing and future backups.  

  2. Binary authentication tokens can be extracted from the user’s computer with a tool available with Elcomsoft Phone Breaker. If you don’t own the product, the token extraction tool is also available in the free evaluation version of Elcomsoft Phone Breaker

All Features and Benefits

WhatsApp Acquisition from Android

Elcomsoft Explorer for WhatsApp can extract WhatsApp conversations directly from a wide range of Android smartphones. As WhatsApp securely encrypts its databases, root access is recommended (but not required) for acquisition. If no root access is available, Elcomsoft Explorer for WhatsApp will employ a workaround by pushing an acquisition tool into the phone temporarily for extracting the decryption key.

If root access is available, Elcomsoft Explorer for WhatsApp can extract WhatsApp conversations from Android handsets running Android 4.0 through 7.1.1. Without root access, compatibility is limited to Android versions 4.0 through 6.0.1.

Downloading Proprietary WhatsApp Backups

WhatsApp has the ability to create cloud backups of its database, saving them in Apple iCloud Drive. Unlike iOS devices that are unique per Apple device, WhatsApp backups are unique per phone number. This means that regardless of how many Apple devices the user has registered under their Apple account, the number of available WhatsApp backups in the user’s iCloud Drive will depend on how many different phone numbers are used within the Apple account.

WhatsApp can be configured to create backups in iCloud Drive even if the device does not have iCloud backups enabled. Elcomsoft Explorer for WhatsApp can extract and decrypt proprietary WhatsApp backups from iCloud Drive. When obtaining a decryption key, one-time access to the user’s phone number or SIM card is required to receive a verification code.

Information Available in WhatsApp Databases

WhatsApp is an instant messaging application. Its databases contain information about peer-to-peer communications between users, including the following records:

WhatsApp Database Content

  • Sent and received text messages complete with contact ID’s and timestamps
  • User’s contact database complete with phone numbers
  • Calls
  • Pictures sent and received, complete with timestamps and contact ID’s
Viewing and Exporting

Elcomsoft Explorer for WhatsApp is equipped with a built-in viewer supporting multiple WhatsApp databases extracted from various sources. The viewer includes instant filtering and quick search functionality. Finding a certain contact, message or conversation is easy by specifying a date range or typing a partial key word into the search box.


The built-in data export facility enables exporting WhatsApp data into a standard Excel-compatible XLSX file. Experts can use these files to continue their investigation in the product of their choice.

Video Tutorial

System requirements

Windows

  • Windows 7 (32 bit)
  • Windows 7 (64 bit)
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows Server 2012

Requirements to Download WhatsApp Databases from the Cloud

The Standard edition of Elcomsoft Explorer for WhatsApp can download information from Apple iCloud and iCloud Drive[1]. In order to be able to download information from Apple iCloud/iCloud Drive, the correct Apple ID and password are required.

In addition, one can use a binary authentication token extracted from the user’s PC or Mac. For extracting binary authentication tokens, we recommend using a tool from Elcomsoft Phone Breaker (if you don’t own a license, the evaluation version will work just fine).

Trial limitations

10 records to view


  1. WhatsApp encrypts its cloud backups. In order to decrypt the backups, one-time access to the user’s registered phone number or SIM card is required. The decryption key is permanent, and can be used to decrypt existing and future backups.  

Release notes

Elcomsoft Explorer for WhatsApp v.2.20.21822

19 October, 2017

  • added full iOS 11 support
  • added support for latest versions of WhatsApp
  • added export into Microsoft Excel format
  • fixed a problem with WhatsApp backup decryption from iCloud Drive

Uninstallation procedure: in order to uninstall the product, follow the standard procedure via Control Panel - Programs and features or use the corresponding Unistall link from the product's folder in the Windows Start menu.

System requirements

Windows

  • Windows 7 (32 bit)
  • Windows 7 (64 bit)
  • Windows 8
  • Windows 8.1
  • Windows 10
  • Windows Server 2012

Requirements to Download WhatsApp Databases from the Cloud

The Standard edition of Elcomsoft Explorer for WhatsApp can download information from Apple iCloud and iCloud Drive[1]. In order to be able to download information from Apple iCloud/iCloud Drive, the correct Apple ID and password are required.

In addition, one can use a binary authentication token extracted from the user’s PC or Mac. For extracting binary authentication tokens, we recommend using a tool from Elcomsoft Phone Breaker (if you don’t own a license, the evaluation version will work just fine).

Trial limitations

10 records to view


  1. WhatsApp encrypts its cloud backups. In order to decrypt the backups, one-time access to the user’s registered phone number or SIM card is required. The decryption key is permanent, and can be used to decrypt existing and future backups.  

Release notes

Elcomsoft Explorer for WhatsApp v.2.20.21822

19 October, 2017

  • added full iOS 11 support
  • added support for latest versions of WhatsApp
  • added export into Microsoft Excel format
  • fixed a problem with WhatsApp backup decryption from iCloud Drive

Uninstallation procedure: in order to uninstall the product, follow the standard procedure via Control Panel - Programs and features or use the corresponding Unistall link from the product's folder in the Windows Start menu.

Buy Elcomsoft Explorer for WhatsApp

Standard Edition
$ 79
Buy now