Forensic Analysis Of Messaging App Database Sqlite — Complete Documentation & Simulation

Overview & System Context

Forensic Analysis Of Messaging App Database Sqlite: Comprehensive Web-Sourced Technical Investigation Exhaustive Research Dossier · Pure Web-Scraped Content: ~8290 Words · Real Software Screenshots: 3 1. Executive Overview & Technical Background Signal is an open-source, encrypted messaging service for instant messaging, voice calls, and video calls. The instant messaging function includes sending text, voice notes, images, videos, and other files. Communication may be one-to-one between users or may involve group messaging. The application uses a centralized computing architecture and is cross-platform software. It is developed by the nonprofit Signal Foundation and its subsidiary Signal Messenger LLC. Signal's software is free and open-source. Its mobile clients, desktop client, and server are all published under the AGPL-3.0-only license. The official Android app generally uses the proprietary Google Play Services, although it is designed to be able to work without them. Signal is also distributed for iOS and desktop programs for Windows, macOS, and Linux. Registration for desktop use requires an iOS or Android device. Signal uses mobile telephone numbers to register and manage user accounts, though configurable usernames were added in March 2024 to allow users to hide their phone numbers from other users. After removing support for SMS on Android in 2023, the app now secures all communications with end-to-end encryption. The client software includes mechanisms by which users can independently verify their contacts' identities and the data channel's integrity. The nonprofit Signal Foundation was launched in February 2018 with initial funding of $50 million from WhatsApp co-founder Brian Acton. As of January 2025, the platform had approximately 70 million monthly active users. As of January 2025, it had been downloaded more than 220 million times.

Open Whisper Systems' website was launched in January 2013. In February 2014, Open Whisper Systems introduced the second version of their TextSecure Protocol (now Signal Protocol), which added end-to-end encrypted group chat and instant messaging capabilities to TextSecure. Toward the end of July 2014, they announced plans to merge the RedPhone and TextSecure applications as Signal. This announcement coincided with the initial release of Signal as a RedPhone counterpart for iOS. The developers said that their next steps would be to provide TextSecure instant messaging capabilities for iOS, unify the RedPhone and TextSecure applications on Android, and launch a web client. Signal was the first iOS app to enable end-to-end encrypted voice calls for free. TextSecure compatibility was added to the iOS application in March 2015.

From its launch in May 2010 until March 2015, the Android version of Signal (then called TextSecure) included support for encrypted SMS/MMS messaging. From version 2.7.0 onward, the Android application only supported sending and receiving encrypted messages via the data channel. Reasons for this included security flaws of SMS/MMS and problems with the key exchange. Open Whisper Systems' abandonment of SMS/MMS encryption prompted some users to create a fork named Silence (initially called SMSSecure) that is meant solely for the exchange of encrypted SMS and MMS messages. In November 2015, the TextSecure and RedPhone applications on Android were merged to become Signal for Android. A month later, Open Whisper Systems announced Signal Desktop, a Chrome app that could link with a Signal mobile client. At launch, the app could only be linked with the Android version of Signal. On 26 September 2016, Open Whisper Systems announced that Signal Desktop could now be linked with the iOS version of Signal as well. On 31 October 2017, Open Whisper Systems announced that the Chrome app was deprecated. At the same time, they announced the release of a standalone desktop client (based on the Electron framework) for Windows, macOS and certain Linux distributions. On 4 October 2016, the American Civil Liberties Union (ACLU) and Open Whisper Systems published a series of documents revealing that OWS had received a subpoena requiring them to provide information associated with two phone numbers for a federal grand jury investigation in the first half of 2016. Only one of the two phone numbers was registered on Signal, and because of how the service is designed, OWS was only able to provide "the time the user's account had been created and the last time it had connected to the service". Along with the subpoena, OWS received a gag order requiring OWS not to tell anyone about the subpoena for one year. OWS approached the ACLU, and they were able to lift part of the gag order after challenging it in court. OWS said it was the first time they had received a subpoena, and that they were "committed to treating any future requests the same way". In March 2017, Open Whisper Systems transitioned Signal's calling system from RedPhone to WebRTC, also adding the ability to make video calls with the mobile apps.

On 21 February 2018, Moxie Marlinspike and WhatsApp co-founder Brian Acton announced the formation of the Signal Technology Foundation, a 501(c)(3) nonprofit organization whose mission is "to support, accelerate, and broaden Signal's mission of making private communication accessible and ubiquitous". Acton started the foundation with $50 million in funding and became the foundation's executive chairman after leaving WhatsApp's parent company Facebook in September 2017.

Marlinspike continued as Signal Messenger's first CEO. As of 2020, Signal ran entirely on donations, as a nonprofit. Between November 2019 and February 2020, Signal added iPad support, view-once images and videos, stickers, and reactions. They also announced plans for a new group messaging system and an "experimental method for storing encrypted contacts in the cloud." Signal was reportedly popularized in the United States during the George Floyd protests. Heightened awareness of police monitoring led protesters to use the platform to communicate. Black Lives Matter organizers had used the platform "for several years". During the first week of June, the encrypted messaging app was downloaded over five times more than it had been during the week prior to the murder of George Floyd. In June 2020, Signal Foundation announced a new feature that enables users to blur faces in photos, in response to increased federal efforts to monitor protesters. On 7 January 2021, Signal saw a surge in new user registrations, which temporarily overwhelmed Signal's capacity to deliver account verification messages. CNN and MacRumors linked the surge with a WhatsApp privacy policy change and a Signal endorsement by Elon Musk and Edward Snowden via Twitter. The surge was also tied to the attack on the United States Capitol. International newspapers reported similar trends in the United Arab Emirates. Reuters reported that more than 100,000 people had installed Signal between 7 and 8 January. Between 12 and 14 January 2021, the number of Signal installations listed on Google Play increased from over 10 million to over 50 million. On 15 January 2021, due to the surge of new users, Signal was overwhelmed with the new traffic and was down for all users. On the afternoon of 16 January, Signal announced via Twitter that service had been restored. On 10 January 2022, Moxie Marlinspike announced that he was stepping down from his role as CEO of Signal Messenger. He continues to remain on the Signal Foundation's board of directors and Brian Acton has volunteered to serve as interim CEO during the search for a new CEO. In August 2022, Signal notified 1900 users that their data had been affected by the Twilio breach including user phone numbers and SMS verification codes. At least one journalist had his account re-registered to a device he did not control as a result of the attack. In September 2022 Signal Messaging LLC announced that AI researcher and noted critic of big tech Meredith Whittaker would fill the newly created position of president. In August 2024, Reuters reported on the blocking of Signal in Venezuela and Russia. In Venezuela, the blocking was a result of protests after the controversial presidential elections in which Nicolas Maduro declared his victory. In Russia, the reason was that Signal did not meet the requirements of legislation in the field of countering terrorism and extremism. In May 2026, Signal threatened to leave Canada because of the Lawful Access Act, stating that "Bill C-22 could potentially allow hackers to exploit these very vulnerabilities engineered into electronic systems, with private messaging services serving as an ideal target for foreign adversaries".

Figure 1: Wenda Plush - Type B | Sprunki Plush Signal messages are encrypted with the Signal Protocol (formerly known as the TextSecure Protocol). The protocol combines the Double Ratchet Algorithm, prekeys, and an Extended Triple Diffie–Hellman (X3DH) handshake. It uses Curve25519, AES-256, and HMAC-SHA256 as primitives. The protocol provides confidentiality, integrity, authentication, participant consistency, destination validation, forward secrecy, backward secrecy (a.k.a. future secrecy), causality preservation, message unlinkability, message repudiation, participation repudiation, and asynchronicity. It does not provide anonymity preservation, and requires servers for the relaying of messages and storing of public key material. The Signal Protocol also supports end-to-end encrypted group chats. The group chat protocol is a combination of a pairwise double ratchet and multicast encryption. In addition to the properties provided by the one-to-one protocol, the group chat protocol provides speaker consistency, out-of-order resilience, dropped message resilience, computational equality, trust equality, subgroup messaging, as well as contractible and expandable membership. According to a 2023 technical report, Signal adopted a protocol called Sender Keys for group messaging, and favors the protocol where possible (rather than the double ratchet) for group messaging, even in small groups. In October 2014, researchers from Ruhr University Bochum (RUB) published an analysis of the Signal Protocol. Among other findings, they presented an unknown key-share attack on the protocol, but in general, they found that it was secure. In October 2016, researchers from UK's University of Oxford, Queensland University of Technology in Australia, and Canada's McMaster University published a formal analysis of the protocol. They concluded that the protocol was cryptographically sound. In July 2017, researchers from RUB found during another analysis of group messengers a purely theoretic attack against the group protocol of Signal: A user who knows the secret group ID of a group (due to having been a group member previously or stealing it from a member's device) can become a member of the group.

Since the group ID cannot be guessed and such member changes are displayed to the remaining members, this attack is likely to be difficult to carry out without being detected. As of August 2018, the Signal Protocol has been implemented into WhatsApp, Facebook Messenger, Skype, and Google Allo, making it possible for the conversations of "more than a billion people worldwide" to be end-to-end encrypted. In Google Allo, Skype and Facebook Messenger, conversations are not encrypted with the Signal Protocol by default; they only offer end-to-end encryption in an optional mode. Up until March 2017, Signal's voice calls were encrypted with SRTP and the ZRTP key-agreement protocol, which was developed by Phil Zimmermann. In March 2017, Signal transitioned to a new WebRTC-based calling system that introduced the ability to make video calls. Signal's voice and video calling functionalities use the Signal Protocol channel for authentication instead of ZRTP.

In December 2016, Egypt blocked access to Signal. In response, Signal's developers added domain fronting to their service. This allows Signal users in a specific country to circumvent censorship by making it look like they are connecting to a different internet-based service. As of May 2022, Signal's domain fronting is enabled by default in Egypt, UAE, Oman, Qatar, Iran, Cuba, Pakistan and Uzbekistan. As of January 2018, Signal was blocked in Iran. Signal's domain fronting feature relies on the Google App Engine (GAE) service. This does not work in Iran because Google has blocked Iranian access to GAE in order to comply with U.S. sanctions. In early 2018, Google App Engine made an internal change to stop domain fronting for all countries. Due to this issue, Signal made a public change to use Amazon CloudFront for domain fronting. However, AWS also announced that they would be making changes to their service to prevent domain fronting. As a result, Signal said that they would start investigating new methods/approaches. Signal switched from AWS back to Google in April 2019. In January 2021, Iran removed the app from app stores, and blocked Signal. Signal was later blocked by China in March 2021, followed by its removal from the App Store in China on 19 April 2024. On August 9, 2024, Signal was blocked in Russia. Roskomnadzor claimed that this was due to "violations of the law on combating terrorism and extremism". Around the same time, Signal was also blocked in Venezuela following the contested 2024 presidential election and subsequent protests.

In March 2025, it was revealed that senior members of the Trump administration—including vice president JD Vance, secretary of state Marco Rubio, and defense secretary Pete Hegseth—were using Signal to discuss sensitive information, including details of military attack plans in Yemen. The existence of the chat was disclosed by The Atlantic editor-in-chief Jeffrey Goldberg, who was accidentally added to the chat. Brian Hughes of the National Security Council later confirmed the authenticity of Goldberg's account. On October 4, 2025, The Minnesota Star Tribune reported that Deputy Homeland Security Advisor Anthony Salisbury had been seen in public exchanging information on Signal with other government officials. Subjects discussed included potential troop deployments to Portland, Oregon, upcoming Immigration and Customs Enforcement (ICE) operations in Chicago, Vice President JD Vance's desire to prosecute two unnamed Florida influencers, and Federal Bureau of Investigation director Kash Patel's firing of FBI employees.

Comparison of cross-platform instant messaging clients Comparison of VoIP software Internet privacy List of video telecommunication services and product brands Secure communication Figure 2: Sprunki Wenda Plush - Etsy WhatsApp Messenger, commonly known simply as WhatsApp, is an American social media, instant messaging (IM), and Voice over IP (VoIP) service accessible via desktop and mobile app. Owned by Meta Platforms, the service allows users to send text messages, voice messages, and video messages, make voice and video calls, and share images, documents, user locations, and other content. The service requires a cellular mobile telephone number to register. WhatsApp was launched in May 2009. In January 2018, WhatsApp released a standalone business app called WhatsApp Business which can communicate with the standard WhatsApp client. As of May 2025, the service had 3 billion monthly active users, making it the most popular messenger app. The name of the app is meant to sound like "what's up". The service was created by WhatsApp Inc. of Mountain View, California, which was acquired by Facebook in February 2014 for approximately US$19.3 billion. It became the world's most popular messaging application in 2015, with 900 million users, and had more than 2 billion active users worldwide in February 2020. WhatsApp Business had approximately 200 million monthly users in 2023. By 2016, it had become the primary means of Internet communication in regions including the Americas, the Indian subcontinent, and large parts of Europe and Africa.

At a keynote presentation at the Mobile World Congress in Barcelona in February 2014, Facebook CEO Mark Zuckerberg said that Facebook's acquisition of WhatsApp was closely related to the Internet.org vision. A TechCrunch article said about Zuckerberg's vision:The idea, he said, is to develop a group of basic internet services that would be free of charge to use – "a 911 for the internet". These could be a social networking service like Facebook, a messaging service, maybe search and other things like weather. Providing a bundle of these free of charge to users will work like a gateway drug of sorts – users who may be able to afford data services and phones these days just don't see the point of why they would pay for those data services. This would give them some context for why they are important, and that will lead them to pay for more services like this – or so the hope goes. Three days after announcing the Facebook purchase, Koum said they were working to introduce voice calls. He also said that new mobile phones would be sold in Germany with the WhatsApp brand, and that their ultimate goal was to be on all smartphones. In August 2014, WhatsApp was the most popular messaging app in the world, with more than 600 million users. By early January 2015, WhatsApp had 700 million monthly users and over 30 billion messages every day. In April 2015, Forbes predicted that between 2012 and 2018, the telecommunications industry would lose $386 billion because of "over-the-top" services like WhatsApp and Skype. That month, WhatsApp had over 800 million users. By September 2015, it had grown to 900 million; and by February 2016, one billion. On November 30, 2015, the Android WhatsApp client made links to Telegram unclickable and not copyable. Multiple sources confirmed that it was intentional, not a bug, and that it had been implemented when the Android source code that recognized Telegram URLs had been identified.

(The word "telegram" appeared in WhatsApp's code.) Some considered it an anti-competitive measure; WhatsApp offered no explanation. In November 2025, WhatsApp announced that they would update their About feature, which allows users to add a short message to explain what they are doing. By default, it is set to disappear in 24 hours, but it can be set for a longer amount of time and can be restricted for viewing by other contacts in the Settings menu. According to WhatsApp, this update was made for the incoming Christmas period for users to inform their contacts on their activities during the holidays. Prior to the update, the feature was "largely hidden within the apps menus" and difficult to find, with the reason for updating being that WhatsApp wanted the feature to be used more often. Engadget called the revamped feature "WhatsApp’s version of an AIM away message" and likened it to Instagram's and Facebook's Notes. The rollout to mobile users began the week of the announcement. The updated feature also allows users to reply directly to a contact's About message by tapping on it within a chat.

On February 28, 2019, The New York Times reported that Facebook was "hoping to succeed where Bitcoin failed" by developing an in-house cryptocurrency that would be incorporated into WhatsApp. The project reportedly involved more than 50 engineers under the direction of former PayPal president David A. Marcus. This "Facebook coin" would reportedly be a stablecoin pegged to the value of a basket of different foreign currencies. In June 2019, Facebook said that the project would be named Libra, and that a digital wallet named "Calibra" was to be integrated into Facebook and WhatsApp. After financial regulators in many regions raised concerns, Facebook stated that the currency, renamed Diem since December 2020, would require a government-issued ID for verification, and the wallet app would have fraud protection. Calibra was rebranded to Novi in May 2020. Meta (formerly Facebook) ended its Novi project on September 1, 2022.

Figure 3: Wenda Plush | Sprunki Plush In India, WhatsApp encouraged people to report messages that were fraudulent or incited violence after lynch mobs in India murdered innocent people because of malicious WhatsApp messages falsely accusing the victims of intending to abduct children. There were a series of incidents between 2017 and 2020, after which WhatsApp announced changes for Indian users of the platform that labels forwarded messages as such.

2. System Architecture & Core Working Principles WhatsApp was initially criticized for its lack of encryption, sending information as plaintext. Encryption was first added in May 2012. End-to-end encryption was only fully implemented in April 2016 after a two-year process. As of September 2021, it is known that WhatsApp makes extensive use of outside contractors and artificial intelligence systems to examine certain user messages, images and videos (those that have been flagged by users as possibly abusive); and turns over to law enforcement metadata including critical account and location information. In 2016, WhatsApp was widely praised for the addition of end-to-end encryption and earned a 6 out of 7 points on the Electronic Frontier Foundation's "Secure Messaging Scorecard". WhatsApp was criticized by security researchers and the Electronic Frontier Foundation for using backups that are not covered by end-to-end encryption and allow messages to be accessed by third-parties. In 2019, Edward Snowden alarmed: "The problem with applications like WhatsApp is, it was actually designed to have very strong encryption, just the same as the gold standard today which would be the signal messenger or the wire messenger, but then it was bought by Facebook because it was so good, and now Facebook is quite aggressively reducing the security of WhatsApp about once a quarter, and they’re trying to do it as quietly as possible, so a messenger that the people are comfortable using now is actually a danger to you." In May 2019, a security vulnerability in WhatsApp was found and fixed that allowed a remote person to install spyware by making a call which did not need to be answered. In September 2019, WhatsApp was criticized for its implementation of a 'delete for everyone' feature. iOS users can elect to save media to their camera roll automatically. When a user deletes media for everyone, WhatsApp does not delete images saved in the iOS camera roll and so those users are able to keep the images. WhatsApp released a statement saying that "the feature is working properly", and that images stored in the camera roll cannot be deleted due to Apple's security layers. In November 2019, WhatsApp released a new privacy feature that let users decide who can add them to groups. In December 2019, WhatsApp confirmed a security flaw that would allow hackers to use a malicious GIF image file to gain access to the recipient's data. When the recipient opened the gallery within WhatsApp, even if not sending the malicious image, the hack is triggered and the device and its contents become vulnerable. The flaw was patched and users were encouraged to update WhatsApp. On December 17, 2019, WhatsApp fixed a security flaw that allowed cyber attackers to repeatedly crash the messaging application for all members of group chat, which could only be fixed by forcing the complete uninstall and reinstall of the app. The bug was discovered by Check Point in August 2019 and reported to WhatsApp. It was fixed in version 2.19.246 onwards. For security purposes, since February 1, 2020, WhatsApp has been made unavailable on smartphones using legacy operating systems like Android 2.3.7 or older and iPhone iOS 8 or older that are no longer updated by their providers. In April 2020, the NSO Group held its governmental clients accountable for the allegation of human rights abuses by WhatsApp. In its revelation via documents received from court, the group claimed that the lawsuit brought against the company by WhatsApp threatened to infringe on its clients' "national security and foreign policy concerns". However, the company did not reveal names of the end users, which according to a research by Citizen Lab include, Saudi Arabia, Bahrain, Kazakhstan, Morocco, Mexico and the United Arab Emirates. On December 16, 2020, a claim that WhatsApp gave Google access to private messages was included in the anti-trust case against the latter. As the complaint was heavily redacted due to being an ongoing case, it did not disclose whether this was alleged tampering with the app's end-to-end encryption, or Google accessing user backups. In January 2021, WhatsApp announced an updated privacy policy which stated that WhatsApp would share user data with Facebook and its "family of companies" beginning February 2021. Previously, users could opt-out of such data sharing, but the new policy removed this option. The new privacy policy would not apply within the EU, as it is illegal under the GDPR. Facebook and WhatsApp were widely criticized for this move. The enforcement of the privacy policy was postponed from February 8 to May 15, 2021, WhatsApp announced they had no plans to limit the functionality of the app for those who did not approve the new terms. On 2016, Whatsapp launched the cloud backup feature, but it was not until October 15, 2021, when it announced that it would begin offering an end-to-end encryption service for chat backups (stored either on Apple iCloud or Google Drive). The feature is not enabled by default, so it is only when users opt-in that any third party (including both WhatsApp and the cloud storage vendor) loses the ability to read the content. On November 29, 2021, an FBI document was uncovered by Rolling Stone, revealing that WhatsApp responds to warrants and subpoenas from law enforcement within minutes, providing user metadata to the authorities. The metadata includes the user's contact information and address book. In January 2022, an unsealed surveillance application revealed that WhatsApp started tracking seven users from China and Macau in November 2021, based on a request from US DEA investigators. The app collected data on who the users contacted and how often, and when and how they were using the app. This is reportedly not an isolated occurrence, as federal agencies can use the Electronic Communications Privacy Act to covertly track users without submitting any probable cause or linking a user's number to their identity. At the beginning of 2022, it was revealed that San Diego–based startup Boldend had developed tools to hack WhatsApp's encryption, gaining access to user data, at some point since the startup's inception in 2017. The vulnerability was reportedly patched in January 2021. Boldend is financed, in part, by Peter Thiel, a notable investor in Facebook. In September 2022, a critical security issue in WhatsApp's Android video call feature was reported. An integer overflow bug allowed a malicious user to take full control of the victim's application once a video call between two WhatsApp users was established. The issue was patched on the day it was officially reported. In 2025, WhatsApp alerted 90 journalists and other members of civil society that they had been targeted by spyware used by the Israeli technology company Paragon Solutions. In April 2025, a group of Austrian researchers were able to extract 3.5 billion users' phone numbers by being able to make a hundred million contact discovery requests an hour, a flaw that exposed previous warnings from researchers in 2017 were not addressed. The researchers notified Meta (who updated the enumeration problem in October), and deleted their copy of the phone numbers.

In May 2019, WhatsApp was attacked by hackers who installed spyware on a number of victims' smartphones. The hack, allegedly developed by Israeli surveillance technology firm NSO Group, injected malware onto WhatsApp users' phones via a remote-exploit bug in the app's Voice over IP calling functions. A Wired report noted the attack was able to inject malware via calls to the targeted phone, even if the user did not answer the call. In October 2019, WhatsApp filed a lawsuit against NSO Group in a San Francisco court, claiming that the alleged cyberattack violated US laws including the Computer Fraud and Abuse Act (CFAA). According to WhatsApp, the exploit "targeted at least 100 human-rights defenders, journalists and other members of civil society" among a total of 1,400 users in 20 countries. In April 2020, the NSO Group held its governmental clients accountable for the allegation of human rights abuses by WhatsApp. In its revelation via documents received via court, the group claimed that the lawsuit brought against the company by WhatsApp threatened to infringe on its clients' "national security and foreign policy concerns". However, the company did not reveal the names of the end users, which according to research by Citizen Lab include, Saudi Arabia, Bahrain, Kazakhstan, Morocco, Mexico and the United Arab Emirates. In July 2020, a US federal judge ruled that the lawsuit against NSO group could proceed. NSO Group filed a motion to have the lawsuit dismissed, but the judge denied all of its arguments.

In January 2020, a digital forensic analysis revealed that the Amazon founder Jeff Bezos received an encrypted message on WhatsApp from the official account of Saudi Arabia's Crown Prince Mohammed bin Salman. The message reportedly contained a malicious file, the receipt of which resulted in Bezos' phone being hacked. The United Nations' special rapporteur David Kaye and Agnes Callamard later confirmed that Jeff Bezos' phone was hacked through WhatsApp, as he was one of the targets of Saudi's hit list of individuals close to The Washington Post journalist Jamal Khashoggi.

On May 9, 2014, the government of Iran announced that it had proposed to block the access to WhatsApp service to Iranian residents. "The reason for this is the assumption of WhatsApp by the Facebook founder Mark Zuckerberg, who is an American Zionist", said Abdolsamad Khorramabadi, head of the country's Committee on Internet Crimes. Subsequently, Iranian president Hassan Rouhani issued an order to the Ministry of ICT to stop filtering WhatsApp. It was once again blocked in September 2022 but unblocked in December 2024.

In Russia, authorities increased pressure on WhatsApp in late 2025. On 28 November 2025, officials warned of a potential full ban on the service. On 11 February 2026, the Russian government fully blocked WhatsApp, which had at least 100 million users in the country until recently, citing its alleged failure to comply with domestic regulations concerning extremist content and state oversight requirements. As per the BBC report, the decision had been made "due to Meta's unwillingness to comply with the norms and the letter of Russian law". Meta could resume operations, if it complies with the law and enters into dialogue.

A WhatsApp Business app for small companies An Enterprise Solution known as WhatsApp Business Platform for bigger companies with global customer bases, such as airlines, e-commerce retailers and banks, who would be able to offer customer service and conversational commerce (e-commerce) via WhatsApp chat, using live agents or chatbots (as far back as 2015, companies like Meteordesk had provided unofficial solutions for enterprises to attend to large numbers of users, but these were shut down by WhatsApp) This solution was originally available as on-premise only, but in 2022, WhatsApp Cloud API became available. The on-premise API has been deprecated and will be fully sunset on October 23, 2025. As WhatsApp API does not have a frontend interface, businesses need to subscribe through one of Meta's approved Business Solution Providers. Examples of these include respond.io, Gupshup, Trengo, Wati and Manychat. In October 2020, Facebook announced the introduction of pricing tiers for services offered via the WhatsApp Business API, charged on a per-conversation basis. On July 1, 2025, a new pricing tier system came into effect which charges per-message rather than per-conversation. In May 2026, WhatsApp launched AI-powered business tools in India for small businesses, enabling automated customer interactions, marketing assistance, and support services through WhatsApp Business.

Comparison of cross-platform instant messaging clients Comparison of user features of messaging platforms Comparison of VoIP software – Voice over IP software comparison Criticism of Facebook Instagram – Social media platform owned by Meta List of most-downloaded Google Play applications List of most popular social platforms Mobile device forensics is a branch of digital forensics relating to recovery of digital evidence or data from a mobile device under forensically sound conditions. The phrase mobile device usually refers to mobile phones; however, it can also relate to any digital device that has both internal memory and communication ability, including PDA devices, GPS devices and tablet computers. Mobile devices can be used to save several types of personal information such as contacts, photos, calendars and notes, SMS and MMS messages. Smartphones may additionally contain video, email, web browsing information, location information, and social networking messages and contacts. There is growing demand for mobile forensics due to several reasons and some of the prominent reasons are: Use of mobile phones to store and transmit personal and corporate information Use of mobile phones in online transactions Use of mobile phone devices by criminals Mobile device forensics can be particularly challenging on a number of levels: Evidential and technical challenges exist. For example, cell site analysis following from the use of a mobile phone usage coverage is not an exact science. Consequently, whilst it is possible to determine roughly the cell site zone from which a call was made or received, it is not yet possible to say with any degree of certainty that a mobile phone call emanated from a specific location e.g. a residential address.

To remain competitive, original equipment manufacturers frequently change mobile phone form factors, operating system file structures, data storage, services, peripherals, and even pin connectors and cables. As a result, forensic examiners must use a different forensic process compared to computer forensics. Storage capacity continues to grow thanks to demand for more powerful "mini computer" type devices. Not only the types of data but also the way mobile devices are used constantly evolve.

Hibernation behavior in which processes are suspended when the device is powered off or idle, but at the same time remaining active. As a result of these challenges, a wide variety of tools exists to extract evidence from mobile devices; no one tool or method can acquire all the evidence from all devices. It is therefore recommended that forensic examiners, especially those wishing to qualify as expert witnesses in court, undergo extensive training in order to understand how each tool and method acquires evidence; how it maintains standards for forensic soundness; and how it meets legal requirements such as the Daubert standard or Frye standard.

The forensics process for mobile devices broadly matches other branches of digital forensics; however, some particular concerns apply. Generally, the process can be broken down into three main categories: seizure, acquisition, and examination/analysis. Other aspects of the computer forensic process, such as intake, validation, documentation/reporting, and archiving still apply.

The second step in the forensic process is acquisition, in this case usually referring to retrieval of material from a device (as compared to the bit-copy imaging used in computer forensics). Due to the proprietary nature of mobiles it is often not possible to acquire data with it powered down; most mobile device acquisition is performed live. With more advanced smartphones using advanced memory management, connecting it to a recharger and putting it into a faraday cage may not be good practice. The mobile device would recognize the network disconnection and therefore it would change its status information that can trigger the memory manager to write data. Most acquisition tools for mobile devices are commercial in nature and consist of a hardware and software component, often automated.

Early investigations consisted of live manual analysis of mobile devices; with examiners photographing or writing down useful material for use as evidence. Without forensic photography equipment such as Fernico ZRT, EDEC Eclipse, or Project-a-Phone, this had the disadvantage of risking the modification of the device content, as well as leaving many parts of the proprietary operating system inaccessible. In recent years a number of hardware/software tools have emerged to recover logical and physical evidence from mobile devices. Most tools consist of both hardware and software portions. The hardware includes a number of cables to connect the mobile device to the acquisition machine; the software exists to extract the evidence and, occasionally, even to analyze it. Most recently, mobile device forensic tools have been developed for the field.

This is in response both to military units' demand for fast and accurate anti-terrorism intelligence, and to law enforcement demand for forensic previewing capabilities at a crime scene, search warrant execution, or exigent circumstances. Such mobile forensic tools are often ruggedized for harsh environments (e.g. the battlefield) and rough treatment (e.g. being dropped or submerged in water). Generally, because it is impossible for any one tool to capture all evidence from all mobile devices, mobile forensic professionals recommend that examiners establish entire toolkits consisting of a mix of commercial, open-source, broad support, and narrow support forensic tools, together with accessories such as battery chargers, Faraday bags or other signal disruption equipment, and so forth.

3. Software Implementation, Frameworks & Protocols Desoldering the chips is done carefully and slowly, so that the heat does not destroy the chip or data. Before the chip is desoldered the PCB is baked in an oven to eliminate remaining water. This prevents the so-called popcorn effect, at which the remaining water would blow the chip package at desoldering. There are mainly three methods to melt the solder: hot air, infrared light, and steam-phasing. The infrared light technology works with a focused infrared light beam onto a specific integrated circuit and is used for small chips. The hot air and steam methods cannot focus as much as the infrared technique.

The first is to use a stencil. The stencil is chip-dependent and must fit exactly. Then the tin-solder is put on the stencil. After cooling the tin the stencil is removed and if necessary a second cleaning step is done. The second method is laser re-balling. Here the stencil is programmed into the re-balling unit. A bondhead (looks like a tube/needle) is automatically loaded with one tin ball from a solder ball singulation tank. The ball is then heated by a laser, such that the tin-solder ball becomes fluid and flows onto the cleaned chip. Instantly after melting the ball the laser turns off and a new ball falls into the bondhead. While reloading, the bondhead of the re-balling unit changes the position to the next pin. A third method makes the entire re-balling process unnecessary. The chip is connected to an adapter with Y-shaped springs or spring-loaded pogo pins. The Y-shaped springs need to have a ball onto the pin to establish an electric connection, but the pogo pins can be used directly on the pads on the chip without the balls. The advantage of forensic desoldering is that the device does not need to be functional and that a copy without any changes to the original data can be made. The disadvantage is that the re-balling devices are expensive, so this process is very costly and there are some risks of total data loss. Hence, forensic desoldering should only be done by experienced laboratories.

Call logs, SMS messages, and messaging application data are stored as rows in SQLite databases on the internal flash storage of mobile devices. Each platform and each application maintains its own database schema, its own file paths, and its own conventions for timestamps, contact identifiers, and message status flags. A forensic examiner who can locate these databases, extract them intact, and parse their tables correctly can reconstruct a detailed communication timeline showing who contacted whom, when, for how long, and sometimes what was said, even when messages have been deleted.

The two dominant mobile platforms store these artifacts in fundamentally different locations and structures. Android uses a content provider model in which the operating system mediates access to call logs and SMS through defined APIs, with underlying SQLite databases in protected app-specific directories under /data/data/. iOS concentrates native communication data in a small number of databases under /private/var/mobile/Library/, with the most forensically significant being sms.db, which holds both SMS and iMessage records.

Third-party messaging apps such as WhatsApp, Signal, and Telegram maintain their own separate databases within each app's sandboxed container, using schemas that change with application updates. Courts in multiple jurisdictions have accepted communication artifacts extracted from mobile databases as evidence, provided the acquisition and analysis chain is properly documented. In the United States, the Federal Rules of Evidence and case law on digital evidence authentication apply.

In the United Kingdom, forensic examiners follow the ACPO principles and NPCC guidelines. In India, the Bharatiya Sakshya Adhiniyam 2023 governs admissibility of electronic records, replacing the Indian Evidence Act provisions on the same subject. The European Union's GDPR intersects with forensic access to messaging data, particularly when investigators request data from cloud backup providers. Across all these jurisdictions, the reliability of the forensic extraction method and the integrity of the database copy are the primary admissibility concerns.

Android stores call history in a SQLite database accessed through the CallLog.Calls content provider. The underlying file is typically at /data/data/com.android.providers.contacts/databases/calllog.db, though manufacturers sometimes relocate it. The calls table is the forensically relevant table: each row represents one call event with columns for the remote number, the normalized number (E.164 format where available), call type, duration in seconds, and a date column containing a Unix epoch timestamp in milliseconds.

The type column uses integer codes: 1 for incoming, 2 for outgoing, 3 for missed, 4 for voicemail, 5 for rejected. The geocoded_location column, present in Android 6 and later, records the carrier's best guess at the geographic region associated with the calling number. iOS stores call history in a separate SQLite file: /private/var/mobile/Library/CallHistoryDB/CallHistory.storedata. Despite the .storedata extension, this is a standard SQLite database used by Core Data. The ZCALLRECORD table holds individual call entries.

Key columns are ZADDRESS (the remote number), ZDURATION (floating point seconds), ZDATE (a Core Data timestamp, counted in seconds from 1 January 2001, not 1970), ZDIRECTION (0 for incoming, 1 for outgoing), and ZANSWERED (boolean). The distinct epoch origin means iOS timestamps must be converted differently from Android ones: add 978307200 seconds to convert from Core Data epoch to Unix epoch.

4. Practical Deployment, Analysis & Case Studies Both platforms also log FaceTime and VoIP calls within the same tables or in closely adjacent ones. On iOS, FaceTime calls appear in ZCALLRECORD with a ZSERVICE_UUID column identifying the call type. On Android, third-party dialers may write to a separate database in their own app container rather than the system CallLog. A complete call log analysis must check both the system call log and any installed third-party dialer application.

On Android, SMS and MMS messages are managed by the Telephony content provider with the underlying database typically at /data/data/com.android.providers.telephony/databases/mmssms.db. The sms table holds individual SMS messages with columns for address (the remote number), body (message text), date (Unix epoch milliseconds), type (1=received, 2=sent, 3=draft, 4=outbox, 5=failed, 6=queued), and read (0 or 1).

MMS messages, including group messages and messages with attachments, are stored across three related tables: pdu (the message envelope), part (individual MIME parts such as text, image, or audio), and addr (addressing information for each recipient and sender). iOS consolidates both SMS and iMessage traffic into a single database at /private/var/mobile/Library/SMS/sms.db. The message table is the primary forensic target. The service column distinguishes the message type: 'SMS' for traditional SMS, 'iMessage' for Apple's end-to-end encrypted messaging protocol. The is_from_me column (0 or 1) identifies direction. The date column uses the Core Data epoch (seconds from 1 January 2001). The text column holds the message body for SMS; iMessage content may also include attachments referenced through the attachment table.

The handle table in sms.db maps a numeric ID to each contact identifier (a phone number or Apple ID email address). The chat table represents individual conversations or group threads. The chat_message_join table is the many-to-many join between chats and messages. Reconstructing a conversation thread requires joining message, chat_message_join, chat, and handle: a query that forensic tools execute automatically, but that an examiner should understand when verifying tool output or writing custom queries.

WhatsApp is the most widely used messaging application globally, and its database schema is well-documented through community reverse engineering and forensic research. On Android, the primary message database is at /data/data/com.whatsapp/databases/msgstore.db. A second database, wa.db, stores the WhatsApp contact list. WhatsApp also maintains a media folder at /data/data/com.whatsapp/files/Media/ where received images, audio, and video are stored, though only metadata (not file content) appears in msgstore.db itself.

The messages table in msgstore.db (renamed to message in more recent schema versions) contains the core message records. Key columns are key_remote_jid (the WhatsApp contact or group identifier, formatted as phone-number@s.whatsapp.net or group-id@g.us), key_from_me (0=received, 1=sent), timestamp (Unix epoch seconds), data (message text for text messages), and status (integer encoding delivery state: 0=error, 1=pending, 4=sent to server, 5=delivered, 13=read).

The media_mime_type and media_name columns describe attached files. Group messages are identified by the presence of a remote_resource column naming the individual sender within the group. WhatsApp schema changes with application updates. A database extracted from WhatsApp version 2.20 may differ structurally from one extracted from version 2.24. Forensic tools maintain schema mappings for known versions, but an examiner working manually should check the sqlite_master table for the actual column names before querying. WhatsApp on iOS stores its equivalent data in the app container under Library/Application Support/WhatsApp/ChatStorage.sqlite, with a different but analogous schema.

Signal uses SQLCipher to encrypt its message database.

On Android, the encrypted database is at /data/data/org.thoughtcrime.securesms/databases/signal.db. On iOS, it is within the app container. The encryption key is derived from the device's Secret key material. Without the correct decryption key, the database file is cryptographically opaque: there is no practical way to read it through brute force for a properly chosen key.

Decryption is possible in several scenarios. On Android, a physical acquisition of a rooted device can extract the key material from the app's shared preferences file (secret_preferences.xml), which stores the SQLCipher passphrase in plaintext after the key derivation step. Some forensic tools can automate this process against a full physical image. On iOS with a known passcode, forensic tools that can perform a full file system acquisition may be able to extract the database in decrypted form if the keychain entry holding the encryption key is accessible.

If none of these routes are available, Signal's contents are effectively inaccessible from the device alone, and investigators may seek the data from Signal's servers or from cloud backups, where Signal's end-to-end encryption may still apply. 5. Performance Evaluation & Extended Technical Observations When device-side decryption is blocked, cloud sources become relevant. WhatsApp offers Google Drive backups on Android and iCloud backups on iOS that are not end-to-end encrypted by default (though an optional encrypted backup feature exists).

Law enforcement agencies in the US, UK, and India can seek these backup copies through legal process served on the cloud provider. The legal framework governing such requests differs: in the US, the Stored Communications Act (18 U.S.C. § 2703) applies; in the UK, the Investigatory Powers Act 2016; in India, the Information Technology Act 2000 and relevant provisions of the Bharatiya Nagarik Suraksha Sanhita 2023.

SQLite does not overwrite data immediately when a row is deleted. Instead, the storage page containing the deleted row is marked as free and placed on the database's free-list. The data on that page remains physically present until SQLite reuses the page for new writes or until a VACUUM command is executed, which compacts the database and removes free pages. In mobile forensics, this means that deleted SMS messages, call log entries, and messaging app records may be recoverable from the free pages of the database file.

Recovery requires a physical acquisition or a full file system acquisition that captures the raw SQLite file, not just an API-level export. Logical acquisitions through content providers or iTunes backup interfaces return only current live records. Tools such as Cellebrite UFED, Oxygen Forensic Detective, and the open-source SQLite Deleted Records Parser can scan database files for residual data in free pages and unallocated space. The recovered fragments often lack column headers, requiring the examiner to infer field boundaries from the known table schema and the SQLite wire format.

Several factors affect recovery success. A device that has sent and received many messages after the deletion is less likely to retain recoverable data because new writes progressively overwrite free pages. A VACUUM operation or a SQLite WAL checkpoint eliminates free page data entirely. Devices that use full-disk encryption at rest (which includes all modern iOS devices and Android devices with file-based encryption enabled) provide no additional barrier to deleted record recovery once the physical image has been decrypted, but the decryption step itself remains a prerequisite.

The admissibility of recovered deleted records requires careful documentation. The examiner must be able to demonstrate that the acquisition preserved the raw database file without modification, that the tool used to parse free pages is validated, and that the recovered fragments are presented with appropriate confidence qualifiers indicating that they are residual data rather than current records.

Courts in the US (United States v. Bayer, among others) and the UK have considered recovered deleted digital records, and the evidentiary standard in each jurisdiction applies equally to mobile database artifacts. A communication timeline is the central analytical product of messaging artifact analysis. It sequences all contacts, whether calls, SMS messages, or app messages, in chronological order, attributing each to a participant and a channel. The timeline reveals patterns that individual artifact views obscure: a suspect who communicated exclusively through Signal except for one unguarded SMS, call clusters preceding a significant event, or a gap in communication that could indicate device power-off or airplane mode.

Building the timeline accurately requires resolving three technical challenges. First, timestamps from different databases must be converted to a common reference frame. Android call logs use milliseconds from Unix epoch; iOS call history uses seconds from Core Data epoch; WhatsApp uses seconds from Unix epoch; some app versions use nanoseconds. Converting all to UTC before sorting is mandatory. Second, contact identifiers must be correlated across databases: the same individual may appear as a phone number in the call log, an Apple ID in iMessage, a WhatsApp JID in msgstore.db, and a display name in the device contacts database. Third, message direction (sent vs. received) must be correctly interpreted from the integer flags specific to each database.

Harvested Online Documentation & Reference Sources • https://en.wikipedia.org/wiki/Signal%20%28software%29 • https://en.wikipedia.org/wiki/WhatsApp • https://en.wikipedia.org/wiki/Mobile%20device%20forensics • https://forensicspot.com/topics/mobile-and-network-forensic/call-logs-sms-and-messaging-app-artifacts • https://www.cyberforensicacademy.com/blog/sqlite-forensics-tools-for-chat-app-artifact-recovery