Get Atlas
FEATURES

Everything you need, from extraction to report

From an encrypted backup or a live device to a record you can hand over.

Android & iOS examination

Process authorized WhatsApp evidence from Android and iOS acquisition sources and backups.

Encrypted WhatsApp databases

Process compatible crypt12, crypt14 and crypt15 databases when valid authorized key material is available.

Message & chat analysis

Review conversations, participants, message activity, reactions, forwards and other available content.

Media examination

Search and review WhatsApp media and correlate attachments with their originating conversations.

Document search

Search message content and searchable/OCR-derived text from document attachments.

Calls & activity

Review available call activity, daily patterns, contact activity and export call records.

Locations, timeline & groups

Examine shared locations, live-location paths, a combined case timeline, group activity and participant information.

Historical database comparison

Compare multiple Android msgstore snapshots and incremental backups to find messages, media and whole chats missing from the newest one, recover deleted chats as HTML, and see what was edited or deleted, and when.

Integrity analysis

SHA-256 input hashing, media completeness review and integrity/deletion-related indicators.

Message provenance

Android: sending device, device/server/received times, receipts, edit and revoke events and media hashes for each message, plus a device timeline.

Media recovery by hash

Match missing media to extra evidence by SHA-256, flag thumbnail-only items, and optionally re-download after explicit confirmation.

Identity & fraud indicators

Number, name and group changes, payments, business and Meta AI messages, forwarded content and foreign-number mix, shown as indicators for a human reviewer.

Case time zone

Pick one time zone per case; every view, report and export uses it while stored evidence stays in UTC.

Forensic reporting

Generate structured HTML/JSON reports and export chats, document/media bundles and call CSVs.

Acquisition and decryption

  • Pull WhatsApp data from a connected Android device over ADB on USB or Wi-Fi, including Android 11+ wireless pairing
  • Import an existing Android acquisition as a folder or ZIP; Atlas finds the relevant WhatsApp structures and pre-fills the fields
  • Process crypt12, crypt14 and crypt15 databases with a key file or a 64-character hexadecimal key
  • Live iOS acquisition takes a full device backup over USB; or use an existing iOS backup folder
  • Password-protected iOS backups are supported when the correct backup password is supplied

Analytics workspace: 16 views

  • Every view can be focused on a single chat, and most respond to a date range
  • Overview: Case KPIs, timeline, media completeness and high-level findings.
  • Chats: List and inspect conversations; open chat detail and export.
  • Content: Message activity, types, reactions, forwards and polls.
  • Media: Browse, filter, preview and trace attachments back to chats.
  • Groups: Participants, roster changes and group activity.
  • Calls: Call KPIs, by-day and by-contact analysis, group calls, CSV export.
  • Signals: Ephemeral / view-once and related activity indicators.
  • Links & Mentions: Extracted links and contact/vCard mentions.
  • Locations & Timeline: Shared-location map, frequent places, live-location paths and a combined case timeline.
  • Search: Keyword search across messages and document text/OCR.
  • Contacts & Map: Contact relationships and correlation views.
  • Deleted Msg: Deleted chats, messages, media and documents from snapshot comparison, and what incremental backups recorded.
  • Activity: Communication classes (people, groups, channels, Meta AI, bots), business and Meta AI messages, payments.
  • Identity: Number, name, username and group changes, admin roster and role changes.
  • Fraud pack: Payments, flagged media, heavily forwarded content, business messages and foreign-number indicators.
  • Integrity: Media completeness, integrity findings and deletion indicators.

Search and document search

  • Keyword search across message text, scoped by chat and date range
  • Searches text in document attachments; PDFs with a text layer directly, others via OCR
  • Export documents and chats together as an examination bundle
  • OCR output is derived text: validate it against the original document

Historical deletion analysis (Android)

  • Multi-DB mode compares msgstore snapshots; the newest becomes the main case
  • Surfaces records, media and document references present earlier but absent from the newest snapshot
  • Writes a standalone multi_db_deletion_report.json
  • Decodes incremental backups to show which messages were edited or deleted, and when
  • Recovers whole deleted chats as HTML
  • Matches missing media to extra evidence by SHA-256; optional, confirmed re-download
  • A missing record is a forensic lead, not proof of intentional deletion

Forensic integrity

  • SHA-256 hashes of key normalized inputs are recorded in the case manifest
  • Media completeness check compares message references with files found in the case workspace
  • Integrity view collects discrepancies, deleted-chat traces and deletion-related indicators

Android and iOS differences

  • Android only: message provenance, device timeline, payments, media recovery by hash, most deletion indicators
  • iOS: full-backup acquisition; no sending-device data, and calls come from the system call history, not a WhatsApp-only log
  • All findings are indicators for the examiner to correlate with acquisition logs and other evidence

Reporting and export

  • Automatic HTML and JSON case report after each analysis run
  • Interactive reports as HTML or PDF, with full or short summary, media scope and an optional company logo
  • Report sections for calls, identity, fraud indicators, live-location paths and the case timeline
  • Self-contained chat exports with media, plus call-log CSV export
  • Exports are derived artifacts, kept alongside the original case and source evidence

Security and licensing

  • Case analysis data is encrypted at rest with a server-issued case key
  • Machine-bound license, verified at checkpoints such as extraction and case access
  • Internet access is needed for license activation and case-key verification