Forensics

Whapa – Comprehensive Guide To The WhatsApp Forensic Toolset

In an era dominated by messaging apps, WhatsApp has become a key platform for personal and professional communication. As WhatsApp messages often contain critical information, it’s vital to have the means to extract and analyze them for security or forensic investigations. Whapa is a powerful toolset designed specifically for analyzing WhatsApp data from Android and iOS devices. Developed in Python, Whapa is compatible across platforms, including Linux, Windows, and macOS.

Key Features of Whapa

Whapa consists of several tools tailored to forensic analysis. Each tool addresses specific aspects of WhatsApp data, whether stored on the device itself or in backups. The suite works seamlessly on both Android and iOS, ensuring wide compatibility for investigators.

Android Tools:
- Whapa (WhatsApp Parser): This tool parses and extracts WhatsApp data from Android databases. It is optimized for older versions of WhatsApp databases but still provides critical data extraction capabilities.
- Whacipher: This tool decrypts WhatsApp message encryption, making it easier to read encrypted messages. However, it does not support Crypt15 encryption, which is used in newer versions of WhatsApp.
- Whagodri: For those using Google Drive backups, this tool extracts WhatsApp data from the cloud, which is essential for users who back up their data online.
- Whamerge: Merging multiple WhatsApp databases is simple with Whamerge, enabling forensic analysts to combine data for thorough examination.
- Whachat: This tool helps export WhatsApp chats into readable formats for better analysis.
iPhone Tools:
- Whacloud: This tool extracts WhatsApp data from iCloud backups. Note that this tool is currently non-functional, and users may need to explore alternatives for iPhone data extraction.
- Whachat: Just like its Android counterpart, Whachat helps export iPhone WhatsApp chats.

Installation and Setup

Setting up Whapa is easy and can be done in a few simple steps. Follow the instructions for your operating system to install the necessary dependencies.

Linux and macOS Users:

To get started, first clone the repository:

git clone https://github.com/B16f00t/whapa.git && cd whapa

Next, install the required dependencies using pip:

pip3 install --upgrade -r ./doc/requirements.txt

Windows Users:

On Windows, clone the repository as well:

git clone https://github.com/B16f00t/whapa.git && cd whapa

Then, install dependencies with:

pip install --upgrade -r .\doc\requirements.txt

To run Whapa, use the following command for Linux/macOS:

python3 whapa-gui.py

For Windows, use:

python whapa-gui.py

Alternatively, you can click on whapa-gui.bat to launch the GUI.

Conclusion

Whapa is a valuable tool for anyone performing WhatsApp forensic analysis. It allows investigators to extract and decrypt essential data from both Android and iOS devices. Despite some limitations with newer WhatsApp versions and iCloud backup extraction, Whapa remains a leading tool for digital forensic investigations. It provides all the essential tools needed to examine WhatsApp data with ease.

To stay updated or contribute to the project, visit the Whapa GitHub repository.

Andriller : Software Utility With A Collection Of Forensic Tools For Smartphones

January 15, 2020

In "Kali Linux"

Andriller CE (Community Edition) – A Comprehensive Guide To Mobile Forensics

May 15, 2024

In "Forensics"

DFIRTriage : Digital Forensic Acquisition Tool For Windows Based Incident Response

November 12, 2019

In "Kali Linux"

0xSnow

0xSnow is a cybersecurity researcher with a focus on both offensive and defensive security. Working with ethical hacking, threat detection, Linux tools, and adversary simulation, 0xSnow explores vulnerabilities, attack chains, and mitigation strategies. Passionate about OSINT, malware analysis, and red/blue team tactics, 0xSnow shares detailed research, technical walkthroughs, and security tool insights to support the infosec community.