Pro plugin

WhatsApp Desktop

Collects chat messages, search indices, contacts, group metadata, session threads, delivery receipts, iCloud backup state, and cached media from WhatsApp Desktop local storage

messaging.whatsappPromacOS 10.15+v1.0.0communicationusermessaging

Run this plugin

Trigger collection for WhatsApp Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messaging.whatsapp --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messaging.whatsapp --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (14)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

messaging

Artifact	Format	Path	Notes
WhatsApp Messages whatsapp_messagesSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Plaintext SQLite database containing all chat messages, conversation threads, and message metadata.
WhatsApp Search Index whatsapp_search_indexSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatSearch.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatSearch.sqlite	Full-text search index containing indexed message content and sender identifiers.
WhatsApp Contacts whatsapp_contactsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Contact identifiers in <number>@s.whatsapp.net format extracted from chat records.
WhatsApp Groups whatsapp_groupsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Group chat metadata including group names, participant lists, and admin designations.
WhatsApp Sessions whatsapp_sessionsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Chat session metadata from ZWACHATSESSION including thread identifiers, last message timestamps, and unread counts.
WhatsApp Receipts whatsapp_receiptsSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Per-recipient delivery, read, and played receipts from ZWAMESSAGERECEIPT providing precise timing of message interactions.
WhatsApp Deleted Messages whatsapp_deleted_messagesSensitivehigh value	sqlite	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite` +1 more ~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/ChatStorage.sqlite	Traces of deleted messages recoverable from database records and WAL files.
WhatsApp Electron Messages whatsapp_electron_messagesSensitivemedium value	binary	`~/Library/Application Support/WhatsApp/IndexedDB/` +1 more ~/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/IndexedDB/	Messages and data from the legacy Electron app's IndexedDB/LevelDB storage.

metadata

Artifact	Format	Path	Notes
WhatsApp iCloud State whatsapp_icloud_statemedium value	directory	`~/Library/Mobile Documents/WhatsApp/`	iCloud Mobile Documents sync state, placeholder files, and directory listings.
WhatsApp Backup Metadata whatsapp_backup_metadatamedium value	binary_plist	`~/Library/Mobile Documents/WhatsApp/Accounts/*/backup/Backup.plist`	Backup.plist containing backup timestamps, sizes, and account metadata.
WhatsApp Extension Data whatsapp_extension_datalow value	binary_plist	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Library/Preferences/*.plist`	ServiceExtension preferences and notification configuration data.
WhatsApp Raw Files whatsapp_rawOptionalOpt-in	binary	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/` +3 more ~/Library/Mobile Documents/WhatsApp/ ~/Library/Containers/desktop.WhatsApp/ ~/Library/Application Support/WhatsApp/	Raw WhatsApp data files for offline analysis.

media

Artifact	Format	Path	Notes
WhatsApp Media whatsapp_mediaSensitivemedium value	binary	`~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/Media/` +2 more ~/Library/Application Support/WhatsApp/Cache/ ~/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/Cache/	Cached media files including images, videos, documents, and voice messages.
WhatsApp Media Archive whatsapp_media_archiveOptionalOpt-inSensitivemedium value	binary	`~/Library/Mobile Documents/WhatsApp/Accounts//backup/.tar`	Files extracted from unencrypted tar backup archives in iCloud Mobile Documents.