Experts raises concerns over WhatsApp’s end-to-end chat encryption; claims full recovery of encrypted chats possible using…

whatsapp

A new digital forensics demonstration shared by cybersecurity expert Nana Sei Anyemedu highlights an important distinction in how WhatsApp’s end-to-end encryption works. While the platform protects messages during transmission, the recovered data shows that once content reaches a device, it is no longer shielded by encryption. This gap allows forensic tools to extract complete chat histories from unlocked or lawfully accessed smartphones.

The demonstration, conducted on an iPhone 16 Pro running iOS 26.1, confirms that WhatsApp stores messages and media inside local databases on the device. These include files such as msgstore.db and other SQLite database formats that retain the complete messaging timeline.

Once a device is unlocked, decrypted, or accessed using forensic tools such as Cellebrite or Oxygen, investigators can read these databases in full. The extracted information can include:

Full message timelines

Timestamps and participant details

Photos, videos, voice notes, and document attachments

Potentially recoverable deleted messages

Despite the familiar banner that reads “Messages are now secured with end-to-end encryption” at the top of every WhatsApp chat, the encryption applies only to data moving between devices—not data stored on them.

WhatsApp End-to-End Encryption vs. Forensic Extraction Although WhatsApp uses end-to-end encryption to protect messages, calls, and shared media during transmission, this protection only applies while the data is moving between devices. Once the content reaches the device, it is… pic.twitter.com/CC3jSkJp5s

— Nana Sei Anyemedu (@RedHatPentester) November 27, 2025

End-to-end encryption ensures that WhatsApp servers cannot intercept or read messages during transmission. Encryption keys remain solely on users’ devices. However, once a message reaches the device, it is stored locally in unencrypted form inside WhatsApp’s directories.

Forensics practitioners rely on device-level access rather than intercepting network communication. If investigators obtain lawful access—through a passcode, biometric unlock, or device backup—they can extract the full contents of WhatsApp chats without breaking the encryption protocol itself.

The findings serve as a reminder that device security plays a crucial role in messaging privacy. While WhatsApp protects communication from external interception, users must still manage risks linked to physical device access, weak passcodes, unencrypted backups, or malware.