Elcomsoft Explorer for WhatsApp Extracts Android WhatsApp Backups from Google Drive

2024-11-17 09:15:11 Computer

806

Moscow, Russia - January 24, 2018 - ElcomSoft Co. Ltd. releases a major update to Elcomsoft eXplorer for WhatsApp, the company's all-in-one tool for extracting, decrypting and analyzing WhatsApp communication histories. The tool can now extract and decrypt WhatsApp backups produced by the Android app and stored in the user's Google Account.

"With more than 1.3 billion active users, WhatsApp is by far the popular instant messaging tool in Europe and North America", says Vladimir Katalov, ElcomSoft CEO. "Due to its overwhelming popularity, WhatsApp is frequently used or targeted by the criminals. With our tool, investigators can now access Android users' encrypted WhatsApp communication histories backed up in Google Drive - provided that they have the user's authentication credentials and can receive a confirmation code sent to the user's WhatsApp phone number."

Elcomsoft Explorer for WhatsApp 2.30 adds the ability to access Android users' WhatsApp conversation histories by extracting and decrypting WhatsApp stand-alone backups from Google Drive. Access to the user's Google Account and their verified phone number (SIM card) is required to obtain the encryption key and decrypt the backup.

For several years, WhatsApp has been encrypting its backup databases. Both stand-alone and cloud backups produced by the Android app and are securely protected with industry-standard AES256 encryption. The encryption key is generated by WhatsApp at the time of the first backup. The key is unique per account and per phone number. If the user has multiple WhatsApp accounts and only one Google Account, each WhatsApp account will use a unique encryption key.

If a SIM card with a verified phone number is available, Elcomsoft Explorer for WhatsApp 2.30 can generate the cryptographic key required to decrypt the backups by registering itself with WhatsApp as a new device. Once obtained, the cryptographic key will be used to decrypt WhatsApp backups (Google Account authentication credentials or binary authentication token required).

At this time, Elcomsoft Explorer for WhatsApp 2.30 supports all of the following WhatsApp acquisition methods:

- Downloading and decrypting Android WhatsApp backups from Google Drive
- Downloading and decrypting iOS WhatsApp stand-alone backups from Apple iCloud Drive
- Extracting WhatsApp data from iOS system backups (iTunes)
- Downloading and extracting WhatsApp data from iOS cloud backups (iCloud)
- Extracting WhatsApp databases from rooted Android devices (all versions of Android; root access required)
- Producing and extracting WhatsApp backups on pre-Android 7 devices without root access

More information at https://www.elcomsoft.com/exwa.html