← All artifacts

WhatsApp Desktop

WhatsApp Desktop artifacts — chat database, contacts, attachments, and account metadata from the macOS Catalyst app.

Status
available
CLI plugin
messaging.whatsapp
Categories
communication, user

Overview

The macOS WhatsApp Desktop app (Catalyst-based) stores its data in the App Sandbox group container. Unlike Signal, the SQLite databases are not encrypted at rest — meaning a forensic image yields immediate access to messages, contacts, and attachments. This makes WhatsApp Desktop one of the highest-yield third-party messaging artifacts on macOS.

Analysis Tips

  • ZWAMESSAGE: One row per message. ZTEXT is plain text, ZMESSAGEDATE is Cocoa epoch
  • ZWACHATSESSION: One row per chat (1:1 or group). Links to ZWAMESSAGE via ZCHATSESSION
  • ZWAMEDIAITEM: Attachment metadata including the local path to files under Media/
  • Cocoa timestamps: ZMESSAGEDATE is seconds since 2001-01-01 — convert with Unix = Cocoa + 978307200
  • Group chats: ZWAGROUPMEMBER ties members to group chat sessions
  • Catalyst sandbox: Files live under ~/Library/Group Containers/, not ~/Library/Containers/ — easy to miss

Related Artifacts

References

Data sources

ChatStorage.sqliteSQLite

~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/

All WhatsApp messages, conversations, contacts, attachments index, and metadata. Contacts are extracted from chat records here

Media/Binary

~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/

Cached attachment files referenced from ChatStorage

Cache/Binary

~/Library/Application Support/WhatsApp/ and ~/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/

Media cache from the legacy Electron app