There is a new feature built into Cellebrite UFED Cloud within Physical Analyzer surrounding the WhatsApp Web chat.

Navigating to “Cloud” -> “Extraction” -> “Private cloud data,” you will be prompted to enter the full name of the person being examined, examiner names, paths, and multiple other options.

Now, it is possible to search for WhatsApp and then WhatsApp Web chat. You must have access to the user’s mobile device, and it must be lawfully accessible, as you will have to scan a QR code.

When trying to validate, Physical Analyzer will prompt you to scan a QR code and confirm that you have the legal rights, authority, and proper jurisdiction.

You can then choose dates and times, depending on your legal authority, and begin the data collection. Physical Analyzer will collect private cloud data from the WhatsApp web chat based on the QR that was scanned, providing you with access to unique artifacts that you may not otherwise have access to.

Share this post