With UFED Cloud Analyzer 5.2, you can unfold suspect’s daily conversations by extracting WhatsApp backup from Android devices. While conversations are stored locally on the device, a WhatsApp user may backup their content to the cloud and later restore it on new devices, or when downloading the app again. Android device users can store the backup on Google Drive- the backup frequency (daily, weekly or monthly) is configured by the user.
You can access the information stored on Google Drive by utilizing login information from the Android mobile device. The login information contains two elements: the Google login information required to access Google Drive and a device key required to access the WhatsApp messages. If the Google login information has expired, you can use the credentials for the Google account, but to obtain the message you will also need the device key which is available in the account package generated by UFED Physical Analyzer. Without the device key, you can access the WhatsApp backup, however you
will only have access to media files (photos and videos) attached to the message, without the message itself.
When can this become useful in your case?
- When WhatsApp content isn’t available on the device- – a suspect or victim may be using a new device, and did not restore the data.
- When WhatsApp data was deleted from the device.
- When you don’t have access to the device.
- Cloud backup may contain more info than in the device information.
- When the user switches from an iPhone to Android, not all the content is smoothly transferred, since backups act different in iOS and in Android.
Register for a 30-day UFED Cloud Analyzer free trial, and explore how you can extract case-critical information that is only available in the cloud.