Using SQLite Structure Analysis To Retrieve Unsent Messages On WhatsApp Messaging Application

Thecontinuous updates to the WhatsApp application and the emergence of new features such as end-to-end encryption and the “Delete for everyone” feature have made WhatsApp one of the most widely used social networking applications. The “Delete for everyone” feature allows the user to delete messages from both sides i.e. for senders and receivers. This feature poses a challenge for forensics as it is badly exploited by cybercriminals such as they can delete sent messages that can be used as evidence to prove cyber crimes. This paper aims to find a way to recover unsent messages through the “Delete for everyone” feature in WhatsApp. Therefore, a tool called SQLWSP was developed based on analyzing the structure of the SQLite file, which WhatsApp use to store application-specific data such as messages. The results showed that the SQLWSP could extract the free blocks of the pages belonging to the message table of WhatsApp which contain the content of unsent messages.