The History of WhatsApp
Introduction
WhatsApp is one of the world’s most widely used messaging applications, enabling billions of users to exchange text messages, voice notes, images, videos, documents, and voice and video calls.
Since its launch in 2009, WhatsApp has transformed digital communication by providing a simple, reliable, and cost-effective alternative to traditional SMS messaging.
Its widespread adoption has also made it a significant source of digital evidence in forensic investigations, where investigators frequently examine WhatsApp artefacts to reconstruct user activity and communications.
The Origins of WhatsApp
WhatsApp was founded in 2009 by Jan Koum and Brian Acton, both former employees of yahoo.com. The application was initially designed as a status-sharing platform that allowed users to update friends about their availability.
However, the founders quickly recognised the growing demand for mobile messaging services and shifted the focus towards instant messaging.
The name “WhatsApp” was derived from the phrase “What’s up?”, reflecting the application’s goal of facilitating easy communication between users.
Growth and Popularity
The introduction of push notifications on smartphones significantly contributed to WhatsApp’s success. Users could receive messages instantly without repeatedly checking the application. As smartphone adoption increased worldwide, WhatsApp rapidly gained popularity due to several advantages:
- Free messaging over internet connections.
- Cross-platform compatibility.
- Group messaging functionality.
- Multimedia sharing capabilities.
- International communication without SMS charges.
By 2013, WhatsApp had become one of the most popular messaging platforms globally, processing billions of messages every day.
Acquisition by Facebook
In 2014, WhatsApp was acquired by about.meta.com (then Facebook) for approximately $19 billion, one of the largest technology acquisitions in history.
The acquisition provided WhatsApp with substantial resources to expand its infrastructure while maintaining its commitment to simple and secure messaging.
Following the acquisition, WhatsApp continued to grow rapidly, eventually surpassing two billion active users worldwide.
Introduction of End-to-End Encryption
A major milestone in WhatsApp’s history occurred in 2016 when it implemented end-to-end encryption by default for all communications. Developed in collaboration with signal.org� technology, this security feature ensures that only the sender and recipient can read message content.
End-to-end encryption protects:
- Text messages
- Voice messages
- Photos and videos
- Documents
- Voice calls
Video calls
This development significantly enhanced user privacy but also introduced challenges for digital forensic investigations, as message content cannot typically be intercepted in transit.
Evolution of Features
Over the years, WhatsApp has expanded beyond basic messaging to include:
- Voice Calling (2015)
- Users gained the ability to make voice calls over the internet.
- Video Calling (2016)
- Video communication was introduced, allowing face-to-face conversations worldwide.
- WhatsApp Business (2018)
- The launch of whatsapp.com enabled organisations to communicate with customers through dedicated business profiles.
Status Updates
Inspired by social media stories, WhatsApp Status allows users to share photos, videos, and text updates that disappear after 24 hours.
Multi-Device Support
Recent updates allow users to access WhatsApp across multiple devices simultaneously without requiring a constant connection to a primary smartphone.
How WhatsApp Works
WhatsApp operates using an internet connection rather than traditional SMS services.
Messages are transmitted through encrypted channels using end-to-end encryption, ensuring that only the sender and recipient can read the content of communications.
The platform supports individual chats, group conversations, voice and video calls, status updates, and file sharing.
Users can access WhatsApp on smartphones, tablets, and desktop computers, allowing communications to be synchronised across multiple devices. This widespread accessibility makes WhatsApp a significant repository of digital information.
WhatsApp as Digital Evidence
WhatsApp communications are frequently presented as evidence in legal proceedings. Messages may demonstrate conversations between individuals, establish timelines, reveal intentions, or provide evidence of agreements and disputes.
Common forms of WhatsApp evidence include:
- Text messages
- Voice notes
- Shared photographs and videos
- Documents and attachments
- Call logs
- Group chat records
- Location-sharing data
- Contact information
Such evidence may be relevant in criminal investigations, family court proceedings, employment disputes, fraud cases, and civil litigation.
WhatsApp Forensic Artefacts
Digital forensic investigators can recover and analyse numerous WhatsApp artefacts from mobile devices. These artefacts may remain on a device even after a user attempts to delete them.
Key WhatsApp forensic artefacts include:
Message Databases
WhatsApp stores messages within databases on mobile devices. These databases may contain:
- Sent and received messages
- Message timestamps
- Sender and recipient information
- Group chat data
- Deleted message remnants
- Media Files
Images, videos, audio recordings, documents, and voice notes exchanged through WhatsApp may be stored on the device or within backups.
Contact Information
WhatsApp maintains records linking conversations to user contacts and telephone numbers.
Call Records
Voice and video call information may include:
- Call timestamps
- Duration
- Caller and recipient details
- Missed call records
- Group Chat Information
- Forensic analysis can reveal:
- Group membership
- Group administrators
- Join and leave dates
- Group conversation history
Metadata
Metadata associated with WhatsApp communications may provide:
- Date and time information
- Device identifiers
- File creation details
- Account registration information
- Backup Data
WhatsApp backups stored locally or within cloud services may contain historical communications that are no longer visible within the application.
Deleted WhatsApp Messages
One of the most common questions in digital forensics is whether deleted WhatsApp messages can be recovered. The answer depends on several factors, including:
- Device type
- Operating system version
- Time elapsed since deletion
- Availability of backups
- Device usage following deletion
In some cases, forensic tools can recover deleted messages, media files, or fragments of communication. However, successful recovery is never guaranteed.
Challenges for Digital Forensic Investigators
Several factors can complicate WhatsApp investigations:
End-to-End Encryption
WhatsApp’s encryption prevents interception and direct access to message content during transmission.
Data Deletion
Users can delete chats, messages, and media files, potentially reducing available evidence.
Cloud Storage Limitations
Access to cloud backups may require legal authority, credentials, or user consent.
Multiple Devices
Modern WhatsApp accounts can operate across several linked devices, increasing the complexity of investigations.
Use of WhatsApp Evidence in Court
WhatsApp evidence is routinely presented in courts throughout the United Kingdom and other jurisdictions. To be admissible, evidence must generally be:
- Relevant to the issues in dispute
- Properly preserved
- Authenticated
- Collected using accepted forensic procedures
Digital forensic experts may be instructed to recover, analyse, and explain WhatsApp evidence through expert witness reports and court testimony.
WhatsApp Forensic Artefacts
During a forensic examination, investigators can identify and analyse numerous artefacts generated by WhatsApp. These artefacts can provide valuable evidence regarding user activity, communications, file transfers, and account usage.
Chat Databases
One of the most significant sources of evidence is the WhatsApp message database. On Android devices, messages are commonly stored within databases such as:
- msgstore.db
- msgstore.db.crypt files (encrypted databases)
- These databases may contain:
- Sent and received messages
- Deleted message remnants
- Group chat communications
- Message timestamps
- Contact identifiers
- Delivery and read receipt information
Contacts Database
WhatsApp maintains information relating to user contacts. Investigators may recover:
- Contact names
- Telephone numbers
- WhatsApp account identifiers
- Profile information
This information can assist in identifying communication participants.
Media Artefacts
WhatsApp stores shared media in dedicated directories. Forensic artefacts may include:
- Photographs
- Videos
- Audio recordings
- Voice notes
- PDF documents
- Shared files
- Animated GIFs
- Stickers
Metadata associated with media files may reveal creation dates, modification dates, device information, and geolocation data where available.
Voice Notes
Voice notes exchanged through WhatsApp can provide valuable evidential content. Artefacts may include:
- Audio files
- Creation timestamps
- Sender information
- Delivery status
Call Logs
WhatsApp call records can provide evidence of communication between parties. Artefacts may reveal:
- Voice call history
- Video call history
- Call durations
- Missed calls
- Incoming and outgoing calls
- Timestamps
Group Chat Artefacts
Group conversations generate additional forensic evidence, including:
- Group names
- Group descriptions
- Group creation dates
- Membership lists
- Administrator details
- Join and leave events
- Group message history
Deleted Data Artefacts
Even where users delete messages, remnants may remain recoverable. Depending on the device and circumstances, investigators may recover:
- Deleted messages
- Deleted media files
- Database fragments
- Backup copies
File system artefacts
The likelihood of recovery depends on factors such as device usage after deletion and storage architecture.
Profile Information
WhatsApp accounts generate artefacts relating to user identity, including:
- Profile photographs
- Status messages
- Account registration details
- Last-seen information (where available)
- Linked device information
Location Artefacts
Where location sharing has been used, forensic examination may identify:
- Shared locations
- Live location history
- Coordinates
- Associated timestamps
These artefacts can assist in establishing a user’s whereabouts at a specific time.
Linked Devices and WhatsApp Web
Modern versions of WhatsApp support multi-device functionality. Artefacts may reveal:
- Linked computers
- Linked mobile devices
- Device names
- Synchronisation activity
- Login timestamps
Backup Artefacts
Historical evidence may be recovered from backups, including:
- Local device backups
- Cloud backups
- Archived chats
- Historical media files
Backups can sometimes contain communications no longer present within the active application.
Metadata Artefacts
Metadata often provides important contextual information, including:
- Message timestamps
- File timestamps
- User identifiers
- Device information
- Communication patterns
- Account activity records
Such metadata can assist investigators in constructing timelines and verifying events.
Importance of WhatsApp Artefacts in Investigations
WhatsApp artefacts are frequently used in criminal investigations, family court proceedings, employment disputes, fraud investigations, and civil litigation.
When properly acquired and analysed by a digital forensic expert, these artefacts can help establish communication histories, identify participants, reconstruct events, and provide reliable evidence for court proceedings.
Conclusion
WhatsApp has transformed digital communication and has become a significant source of electronic evidence. Despite encryption and privacy protections, valuable forensic artefacts can often be recovered from devices and backups.
Messages, media files, call logs, metadata, and other WhatsApp records frequently play a crucial role in criminal investigations, family court proceedings, civil disputes, and corporate investigations.
As digital communications continue to evolve, the forensic examination of WhatsApp remains an essential area of modern digital forensics.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensics investigation.
Our digital forensic experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years. Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
