01Location
- /private/var/mobile/Containers/Shared/AppGroup/<UUID>/ChatStorage.sqlite (+ -wal, -shm)
- /private/var/mobile/Containers/Shared/AppGroup/<UUID>/ContactsV2.sqlite
- /private/var/mobile/Containers/Shared/AppGroup/<UUID>/CallHistory.sqlite
- /private/var/mobile/Containers/Shared/AppGroup/<UUID>/Message/Media/
- Backup domain: AppDomainGroup-group.net.whatsapp.WhatsApp.shared
02Questions it answers
- Who exchanged messages with the account and when?
- Which media and locations were attached to messages?
- Which WhatsApp calls took place, with whom and for how long?
03Format and versions
| Format | Core Data SQLite. ZWAMESSAGE (ZMESSAGEDATE, ZISFROMME, ZFROMJID, ZTOJID, ZTEXT, ZMESSAGETYPE, ZSTARRED, ZCHATSESSION, ZMEDIAITEM); ZWACHATSESSION (ZCONTACTJID, ZPARTNERNAME); ZWAMEDIAITEM (ZMEDIALOCALPATH, ZXMPPTHUMBPATH, ZMETADATA). ContactsV2.sqlite holds ZWAADDRESSBOOKCONTACT; CallHistory.sqlite holds ZWACDCALLEVENT and participants. |
|---|---|
| Applies to | iLEAPP test images range from iOS 12.4 to iOS 18.7 with WhatsApp builds up to 26.x; some call columns are absent on older stores. |
04Key fields
| Field | What it tells you |
|---|---|
| ZWAMESSAGE.ZISFROMME | 1 outgoing; other values treated as incoming by iLEAPP. |
| ZWAMESSAGE.ZFROMJID / ZTOJID | Sender and recipient JIDs as stored (may be NULL). |
| ZWAMESSAGE.ZTEXT | Message text. |
| ZWACHATSESSION.ZCONTACTJID / ZPARTNERNAME | Chat JID and display name of the chat partner or group. |
| ZWAMEDIAITEM.ZMEDIALOCALPATH | Relative path of the media file under Message/Media. |
| ZWACDCALLEVENT | Call events with ZDATE, ZDURATION, ZOUTCOME (labels unconfirmed) and byte counts. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| ZWAMESSAGE.ZMESSAGEDATE | Apple Cocoa time (seconds since 2001-01-01 UTC) | Message time; add 978,307,200 for Unix time. |
| ZWACDCALLEVENT.ZDATE / ZDURATION | Apple Cocoa time / seconds | Call end is computed from start + duration. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Locate the WhatsApp shared App Group container and collect all three databases with WAL files and media.
- Join ZWAMESSAGE to ZWACHATSESSION and ZWAMEDIAITEM.
- Attach ContactsV2 names as enrichment with left joins.
- Convert Cocoa times and match media paths to files.
07Interpretation pitfalls
- Call aggregate rows can cover more than one call; do not assume one row equals one call.
- Outcome and type labels are not vendor-documented.
- Recent changes may exist only in the WAL file.
09Sources
- iLEAPP — scripts/artifacts/whatsApp.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts Igor Mikhailov, Group-IB (2019) · checked 2026-10-14
- CFAbsoluteTime Apple Developer Documentation · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14