WhatsApp is the most popular chat (audio and video) messaging service and is used by more than a billion people across the globe. It stores its information under the /data/data folder, with the package name, com.whatsapp. The following is an overview of the important files that are of interest from a forensic perspective:

• User's profile pic: The user's profile picture is saved with theme.jpg filename and is present under the following path:
  • Path: /data/data/com.whatsapp/me.jpg
• User's phone number (associated with WhatsApp): The me file that's present under the main folder contains the phone number that is associated with the user's WhatsApp account. Note that this may or may not be the phone number that is associated with the SIM:
  • Path: /data/data/com.whatsapp/me
• Contacts profile pic: The /avatars directory contains thumbnails of the profile pictures of the user's contacts (who use WhatsApp):
  • Path: /data/data/com.whatsapp/files/Avatars
• Chat messages: All message-related information, including chats and sender details, is present in the msgstore.db file, which is present at the following location:
  • Path: /data/data/com.whatsapp/databases/msgstore.db
• WhatsApp files: Most of the files shared with WhatsApp, such as images, videos, and audio messages, are stored on the SD card in the following location:
  • Path: /sdcard/WhatsApp/Media

Both sent and received files are stored separately here in their respective folder names.

Next, we will look at another application that is used for telecommunication and specializes in providing video chat and voice calls: Skype.