01Location
- /data/data/com.whatsapp/databases/wa.db (+ -wal, -shm)
02Questions it answers
- Which WhatsApp identities (JIDs) are known to the account, and with which names and numbers?
- What profile name and status text did a contact show?
- Who is recorded as the creator of a group?
03Format and versions
| Format | SQLite. wa_contacts (jid, is_whatsapp_user, given_name, family_name, display_name, wa_name, number, status, status_timestamp) and wa_group_admin_settings (creator_jid for a group). |
|---|---|
| Applies to | Columns vary by app version; ALEAPP checks for wa_name, status_timestamp and creator_jid before reading them. |
04Key fields
| Field | What it tells you |
|---|---|
| jid | WhatsApp ID of the contact. |
| is_whatsapp_user | 1 if the contact is an actual WhatsApp user, 0 otherwise. |
| display_name / given_name / family_name | Names from the device address book. |
| wa_name | WhatsApp name as set in the contact's profile. |
| number | Phone number associated with the contact; often empty. |
| status | Text in the contact's status line. |
| wa_group_admin_settings.creator_jid | Creator JID recorded for a group; may be a LID JID. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| status_timestamp | Unix epoch, milliseconds | 0 means no value; which event it marks is not established. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Read wa_contacts and keep @newsletter and status@broadcast rows apart from people.
- Join to msgstore.db JIDs, using jid_map for LID identities.
- Report address-book names and wa_name in separate columns.
07Interpretation pitfalls
- An @newsletter JID in wa.db does not show that a channel was followed.
- wa_name may not follow later profile changes; when it was written is not established.
- Presence in wa_contacts does not prove any communication.
09Sources
- ALEAPP — scripts/artifacts/WhatsApp.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts Igor Mikhailov, Group-IB (2019) · checked 2026-10-14