Encrypted backups can be automatically decrypted providing that the correct password is supplied.

The tool supports both rooted and non-rooted Android phones. The tool offers multiple acquisition options to extract and decrypt WhatsApp data from multiple local and cloud sources including Android smartphones, iOS system backups (iTunes and iCloud), and WhatsApp proprietary cloud backups in Google Drive and iCloud Drive. Our extraction process aims to recover deleted files, hidden files, temporary files, file fragments and recordsĪnalysis: the information, once extracted, are analyzed to reconstruct the activities carried out by the digital device.Elcomsoft Explorer for WhatsApp (EXWA) is a Windows tool to acquire, decrypt and display WhatsApp communication histories. Our process ensures that the data is acquired without changing them or damage them, making a forensic copy and checking the integrity with hash functions in order to ensure a proper chain of custodyĮxtraction: working on the acquired forensic copy acquired our consultants extract the data and information in the analyzed media. Digital evidence is by nature fragile and can be easily altered even only by turning on the device that contains it. Our team, working together with the client, identifies the objectives of the analysis, obtains information related to the case and apply the appropriate and specific proceduresĪcquisition: access to digital data without using adequate tools and procedures can make a valuable information inadmissible in court. Identification: digital investigation starts with the planning of the work and the identification of potential containers of information. The working methodology followed conforms to the procedures and international best practices in the field of Digital Forensics (ISO 27037, SWGDE, NIST, UDOJ, UK Acpo, IACIS, ISFCE) and has as its main objective to guarantee the integrity, the accuracy and validity of the original data.

Elcomsoft cloud explorer forensic