Pro plugin

WhatsApp Desktop

Collects chat messages, search indices, contacts, group metadata, session threads, delivery receipts, iCloud backup state, and cached media from WhatsApp Desktop local storage

messaging.whatsappPromacOS 10.15+v1.0.0communicationusermessaging

Run this plugin

Trigger collection for WhatsApp Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messaging.whatsapp --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messaging.whatsapp --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (15 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

messaging

Artifact	Format	Path	Notes
WhatsApp Messages whatsapp_messagesSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Plaintext SQLite database containing all chat messages, conversation threads, and message metadata.
WhatsApp Search Index whatsapp_search_indexSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatSearch.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatSearch.sqlite`	Full-text search index containing indexed message content and sender identifiers.
WhatsApp Contacts whatsapp_contactsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Contact identifiers in <number>@s.whatsapp.net format extracted from chat records.
WhatsApp Groups whatsapp_groupsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Group chat metadata including group names, participant lists, and admin designations.
WhatsApp Sessions whatsapp_sessionsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Chat session metadata from ZWACHATSESSION including thread identifiers, last message timestamps, and unread counts.
WhatsApp Receipts whatsapp_receiptsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Per-recipient delivery, read, and played receipts from ZWAMESSAGERECEIPT providing precise timing of message interactions.
WhatsApp Deleted Messages whatsapp_deleted_messagesSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more `~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite`	Traces of deleted messages recoverable from database records and WAL files.
WhatsApp Electron Messages whatsapp_electron_messagesSensitivemedium value	binary	`~/Library/Application Support/WhatsApp/IndexedDB/` +2 more `~/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/IndexedDB/` `~/Library/Application Support/WhatsApp/main-process.log`	Messages and data from the legacy Electron app's IndexedDB/LevelDB storage, plus the main-process.log diagnostic log.

metadata

Artifact	Format	Path	Notes
WhatsApp iCloud State whatsapp_icloud_statemedium value	directory	`~/Library/Mobile Documents/WhatsApp/`	iCloud Mobile Documents sync state, placeholder files, and directory listings.
WhatsApp Backup Metadata whatsapp_backup_metadatamedium value	binary_plist	`~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/Backup.plist`	Backup.plist containing backup timestamps, sizes, and account metadata.
WhatsApp Extension Data whatsapp_extension_datalow value	binary_plist	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Library/Preferences/*.plist`	ServiceExtension preferences and notification configuration data.
WhatsApp Service Extension whatsapp_service_extensionlow value	binary_plist	`~/Library/Containers/net.whatsapp.WhatsApp.ServiceExtension` +1 more `~/Library/Containers/net.whatsapp.WhatsApp.ServiceExtension/Data/Library/Preferences/net.whatsapp.WhatsApp.ServiceExtension.plist`	ServiceExtension preferences plist and cached notification media thumbnails used for push notification previews.
WhatsApp Raw Files whatsapp_rawOptionalOpt-in	binary	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/` +3 more `~/Library/Mobile Documents/WhatsApp/` `~/Library/Containers/desktop.WhatsApp/` `~/Library/Application Support/WhatsApp/`	Raw WhatsApp data files for offline analysis.

media

Artifact	Format	Path	Notes
WhatsApp Media whatsapp_mediaSensitivemedium value	binary	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Media/` +2 more `~/Library/Application Support/WhatsApp/Cache/` `~/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/Cache/`	Cached media files including images, videos, documents, and voice messages.
WhatsApp Media Archive whatsapp_media_archiveOptionalOpt-inSensitivemedium value	binary	`~/Library/Mobile Documents/WhatsApp/Accounts//backup/.tar`	Files extracted from unencrypted tar backup archives in iCloud Mobile Documents.