Elcomsoft Explorer for WhatsApp 2.80 fixes the ability to download and decrypt WhatsApp backups created by the latest versions of the app and stored in the user’s Google Account. In addition, the new server-based authentication and crypt14 encrypted backups are now supported.

Elcomsoft Explorer for WhatsApp 2.80 is a bugfix and compatibility release, resolving authentication issues with WhatsApp backups in Google Accounts and adding support for the latest versions of WhatsApp. In this release we enabled support for crypt14, which is the latest format of WhatsApp encrypted backups, and added support for the new WhatsApp server authentication.

We are working around the clock to monitor the latest developments in the WhatsApp ecosystem. Even the slightest change to the proprietary authentication and communication protocols may break cloud-based mobile forensic tools, including Elcomsoft Explorer for WhatsApp. We are working hard to maintain our tools and restore cloud-related functionality as soon as possible.

Elcomsoft Explorer for WhatsApp provides the ability to obtain and decrypt WhatsApp backups stored in the user’s Google Account. For cloud acquisition from Google Drive, access to the user’s Google Account and their verified phone number (SIM card) is required to obtain the encryption key and decrypt the backup. Since November 2018, WhatsApp backups in Google Drive no longer count towards the user’s Google Drive storage quota. WhatsApp backups in Google Drive that haven not been updated in more than one year will be automatically removed from Google Drive.

The tool can also obtain iPhone users’ WhatsApp backups by processing local and cloud iOS backups. In addition, stand-alone WhatsApp backups can be obtained from the user’s iCloud Drive.

Release Notes

• Fixed the issue that prevented the downloading and decryption of WhatsApp backups from Google accounts
• Added support for crypt14 backups (both Google Drive and iCloud Drive)
• Fixed the problem with Google Drive authentication when the Google Credentials database is empty
• Fixed the problem with WhatsApp data decryption (added support for the new table format)
• Fixed the problem when only the phone number was shown but not the contact name
• Fixed the problem with call log decryption