| Field |
Value |
| App Name |
WhatsApp |
| Bundle ID |
net.whatsapp.WhatsApp / net.whatsapp.WhatsAppSMB |
| Developer |
TODO |
| Category |
Communication |
| Initial Release |
TODO |
| Analyzed Version |
2.24.1.80 Beta version |
| Platform |
iOS |
| Date Performed |
03-03-2026 |
| Verified? |
False |
| Source |
CTF Image |
| Horizon Added? |
True |
File paths of interest with short notes of type of data:
net.whatsapp.WhatsApp / net.whatsapp.WhatsAppSMB
Data
- Documents:
- /private/var/mobile/Containers/Data/Application/.*/Documents/SyncHistory.plist (NEW_T/P TODO: Confirm data. Currently probably shows last timestamp of sync.)
- Library:
- /private/var/mobile/Containers/Data/Application/.*/Library/Caches/ChatMedia/.* (Tag: Location) (NEW_T/P TODO: Confirm data. Appears to be cached media files from chat messages, can contain map tiles, images, etc.)
- /private/var/mobile/Containers/Data/Application/.*/Library/Caches/spotlight-profile-v2/.* (NEW_T/P TODO: Confirm data. Appears to cache "seen" profiles picture, also Actors profile pic.)
- /private/var/mobile/Containers/Data/Application/.*/Library/Caches/Voip/wa_voip_history.json (NEW_T/P TODO: Confirm data. Records call with timestamp and call participants id)
- /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/net.whatsapp.WhatsApp.plist (Tag: Account) (** TODO: Confirm data. Preference data, might hold actor data)
- /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/UITextInputContextIdentifiers.plist (Tag: Account) (NEW_T/P TODO: Confirm data. Preference data, holds user id's but need to confirm if actors)
- /private/var/mobile/Containers/Data/Application/.*/Library/SplashBoard/Snapshots/net.whatsapp.WhatsApp - {DEFAULT GROUP}/.* (NEW_T/P TODO: Confirm data. Snapshot images, can contain deleted chat messages..)
- /private/var/mobile/Containers/Data/Application/.*/Library/SplashBoard/Snapshots/sceneID_net.whatsapp.WhatsApp-default/.* (NEW_T/P TODO: Confirm data. Snapshot images, can contain deleted chat messages..)
Shared/AppGroup
- Biz:
- /private/var/mobile/Containers/Shared/AppGroup/.*/Biz/Biz.sqlite./* (Data containing business info.)
- FieldStats2
- /private/var/mobile/Containers/Shared/AppGroup/.*/FieldStats2/ServiceExtension/wam-.* (Tag: Account) (NEW_T/P Data can contain device info, actor id)
- fts
- /private/var/mobile/Containers/Shared/AppGroup/.*/fts/ChatSearch.*.sqlite.* (NEW_P TODO: Confirm data. Chat search data)
- Library
- /private/var/mobile/Containers/Shared/AppGroup/.*/Library/Preferences/group.net.whatsapp.WhatsApp.shared.plist (Tag: PoL, Account) (Encrypted?) (Data containing possible Pattern of Life, Current status text, username, phone number but looks encrypted, last auto backup, other pref data.)
- /private/var/mobile/Containers/Shared/AppGroup/.*/Library/Caches/.* (NEW_T TODO: Confirm data, may contain key value pairs in sqlite. I believe this is now in the package root. Keeping this as legacy.)
- Logs
- /private/var/mobile/Containers/Shared/AppGroup/.*/Logs/.*/whatsapp-.*.log (Tag: PoL) (NEW_T/P Various logs, possible PoL, when app launched.)
- Media
- /private/var/mobile/Containers/Shared/AppGroup/.*/Media/Profile/.* (NEW_T/P Profile pictures with thumbnail versions, appear to have user id in file name.)
- Message
- /private/var/mobile/Containers/Shared/AppGroup/.*/Message/Media/.*@s.whatsapp.net (Tag: Location) (NEW_P Media files from chats, both chat app and business app. Can contain map tiles.)
- /private/var/mobile/Containers/Shared/AppGroup/.*/Axolotl.sqlite.* (Tag: Account) (NEW_P user id's, session info)
- /private/var/mobile/Containers/Shared/AppGroup/.*/BackedUpKeyValue.sqlite.* (NEW_T/P TODO: Confirm data)
- /private/var/mobile/Containers/Shared/AppGroup/.*/CallHistory.sqlite.* (**NEW_T Call information: date, participants, direction, etc)
- /private/var/mobile/Containers/Shared/AppGroup/.*/ChatStorage.sqlite.* (Groups and messages)
- /private/var/mobile/Containers/Shared/AppGroup/.*/ContactsV2.sqlite.* (Tag: Account) (Contact information/address book)
- /private/var/mobile/Containers/Shared/AppGroup/.*/current_wallpaper.*.jpg (**NEW_T/P Image/s of current wallpaper)
- /private/var/mobile/Containers/Shared/AppGroup/.*/DeviceAgents.sqlite.* (Tag: Account) (**NEW_T Contains companion device info)
- /private/var/mobile/Containers/Shared/AppGroup/.*/LID.sqlite.* (Tag: Account) (**NEW_T Contains mapping of LID to phone number. LID is an alternate id for users that does not use phone numbers. Can map actors to aliases.)
- /private/var/mobile/Containers/Shared/AppGroup/.*/LocalKeyValue.sqlite.* (**NEW_T Contains key/value pairs (profile pictures, ai assistant metadata.)
- /private/var/mobile/Containers/Shared/AppGroup/.*/Location.sqlite.* (**NEW_T/P TODO: more testing. Contains info on if location was sent or received. Needs more testing and it might not be as valuable.)