
Fast acquisition is made possible by selectively downloading WhatsApp information instead of pulling the entire backup from the cloud. WhatsApp databases are automatically retrieved from iOS backups stored in Apple iCloud.


Two-factor authentication is supported for both Apple and Google accounts. Downloading cloud backups from Apple iCloud and iCloud Drive requires entering the user’s Apple ID and password or using a binary authentication token extracted from the user’s computer, while Google Drive downloads require a login and a password. Encrypted backups can be automatically decrypted providing that the correct password is supplied. The tool supports both rooted and non-rooted Android phones. The tool offers multiple acquisition options to extract and decrypt WhatsApp data from multiple local and cloud sources including Android smartphones, iOS system backups (iTunes and iCloud), and WhatsApp proprietary cloud backups in Google Drive and iCloud Drive. Elcomsoft Explorer for WhatsApp (EXWA) is a Windows tool to acquire, decrypt and display WhatsApp communication histories.
