WhatsApp Desktop

Overview

WhatsApp Desktop on macOS stores its complete chat history as a plaintext, unencrypted SQLite database in a Group Container directory (~/Library/Group Containers/group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite). Any user-level process can read this database without Full Disk Access, without root privileges, and without any decryption keys. This is the defining forensic characteristic of WhatsApp Desktop: a messaging platform that users widely perceive as end-to-end encrypted exposes its entire local message history to any investigator with filesystem access.

This stands in direct contrast to Apple iMessage, whose database at ~/Library/Messages/chat.db requires Full Disk Access (TCC-protected). WhatsApp has no equivalent protection on the macOS Catalyst app.

WhatsApp Desktop has shipped in two distinct variants. The current native Catalyst app (net.whatsapp.WhatsApp, distributed via the Mac App Store) uses Apple's Core Data framework and stores messages in a Core Data SQLite database with ZWA-prefixed entity names. The legacy Electron app (desktop.WhatsApp, deprecated in 2024) stored data in Chromium IndexedDB/LevelDB format. This article covers the native Catalyst app. Legacy Electron storage is noted where relevant for historical cases.

The secondary data source is the iCloud backup located at ~/Library/Mobile Documents/57T9237FN3~net~whatsapp~WhatsApp/Accounts/<phone>/backup/. This directory contains AES-encrypted .enc database files (requiring the user's E2E backup key to decrypt) alongside unencrypted .tar archives containing media, documents, and thumbnails. Investigators can access the tar archives without any decryption keys.

The Critical Finding: Plaintext Group Container

The native WhatsApp Catalyst app is distributed as a sandboxed Mac App Store application, but it uses a shared App Group container (group.net.whatsapp.WhatsApp.shared) rather than its private sandbox container. App Group containers in ~/Library/Group Containers/ are accessible to any process running as the same user — they are specifically designed for inter-process data sharing. WhatsApp uses this mechanism to share the chat database with its notification extension (net.whatsapp.WhatsApp.ServiceExtension), but as a consequence, any user-level process on the system can read ChatStorage.sqlite without any TCC permission prompt or Full Disk Access.

Forensic implication: WhatsApp's end-to-end encryption protects messages in transit. It does not protect messages at rest on the local macOS filesystem. An investigator with physical access to the device, a forensic image, or a live acquisition running as the user has direct access to the complete plaintext message history.

File Locations

Native Catalyst App (Primary)

iCloud Backup (Secondary)

The iCloud backup path encodes both the App Team ID and bundle ID: 57T9237FN3~net~whatsapp~WhatsApp. Account directories are named with the full phone number including country code (e.g., 14155551234).

Extension Containers

Legacy Electron App Paths (Deprecated)

Application Variants

WhatsApp JID Format

WhatsApp uses XMPP-derived Jabber IDs (JIDs) to identify all entities. JIDs appear throughout the database in ZFROMJID, ZTOJID, ZCONTACTJID, ZMEMBERJID, and ZRECEIPTJID columns.

The phone number in @s.whatsapp.net JIDs is the full E.164 international number without the leading + sign. 14155551234 represents +1-415-555-1234. Phone numbers can be extracted directly from JIDs without any additional lookup, enabling identity attribution across the dataset.

Account directories in the iCloud backup path follow the same format — a directory named 14155551234 belongs to that phone number.

Core Data Schema Overview

The native Catalyst app uses Apple Core Data with the following primary entities (tables). All table names carry the ZWA prefix from Core Data code generation.

See Chat Database for complete table schemas and SQL queries.

Timestamp Format

All timestamp columns in the native Catalyst app use the Apple Core Data epoch: seconds (floating-point) since January 1, 2001, 00:00:00 UTC. This is the same epoch used by iMessage, FaceTime, Apple Contacts, and all other Core Data applications.

Conversion formula:

unix_timestamp = core_data_timestamp + 978307200

Example:

Core Data value:  764553600.0
+ 978307200
= Unix timestamp: 1742860800
= 2025-03-24 00:00:00 UTC

SQL conversion:

-- Convert a Core Data timestamp to ISO 8601 in SQLite
SELECT datetime(ZMESSAGEDATE + 978307200, 'unixepoch') AS message_time
FROM ZWAMESSAGE;

Zero values in timestamp columns indicate the timestamp was not set. Null values indicate the column was not applicable (e.g., ZSENTDATE is null for received messages).

Key Artifacts

Chat Database (ChatStorage.sqlite)

The primary forensic artifact. Contains the complete local message history in plaintext — message text, sender JIDs, delivery status, media references, group membership, and read receipts. Accessible without encryption or Full Disk Access. See Chat Database for schema documentation.

Full-Text Search Index (ChatSearch.sqlite)

An FTS (Full-Text Search) database that WhatsApp maintains alongside the main database. The search index may retain indexed text from messages that have since been deleted from ChatStorage.sqlite, making it a potential source for deleted message recovery.

iCloud Backup Directory

A second copy of the chat data synced to iCloud. The SQLite databases are AES-encrypted and require the user's end-to-end backup key to decrypt. However, the .tar archives containing media files are unencrypted and accessible immediately. The Backup.plist metadata file provides size inventory and backup timestamps. See iCloud Backup.

Notification Extension Media

The ServiceExtension container may hold JPEG thumbnail images for incoming message notifications. These can provide visual evidence of media shared in conversations even when the main chat database is unavailable.

macOS Version Support

The Core Data schema is driven by WhatsApp application releases, not macOS versions. Schema column additions occur with WhatsApp app updates and may add columns for features such as message editing, view-once media, disappearing messages, or WhatsApp Channels.

Forensic Analysis Notes

• Phone number attribution is direct: JIDs encode full E.164 phone numbers. Cross-reference @s.whatsapp.net JIDs with Contacts (contacts.addressbook) to resolve names without requiring a WhatsApp account lookup.
• Delivery receipts are per-recipient: ZWAMESSAGEINFO stores a separate row for each group member who received or read the message. For outgoing group messages, ZMESSAGESTATUS on the ZWAMESSAGE row reflects aggregate delivery state, while ZWAMESSAGEINFO provides individual recipient confirmation.
• Forwarded messages: The ZISFORWARDED flag on ZWAMESSAGE indicates a message was forwarded from another conversation. The ZFORWARDCOUNT column tracks how many times the message has been forwarded. This is significant for disinformation or data exfiltration investigations.
• Starred messages: ZSTARRED = 1 marks messages the user explicitly saved. Starred messages often indicate content the user considered important.
• Archived chats: ZWACHATSESSION.ZARCHIVED = 1 indicates the user archived a conversation. Archived chats are hidden from the default view but remain in the database.
• Disappearing messages: ZWACHATSESSION.ZDISAPPEARINGMESSAGEDURATION sets the auto-delete timer. Individual messages already deleted by the timer are removed from the database — but the conversation record remains and the ZMESSAGECOUNTER still reflects the historical total.
• WAL mode: ChatStorage.sqlite operates with SQLite WAL mode. Always collect ChatStorage.sqlite-wal and ChatStorage.sqlite-shm alongside the main file to capture all committed transactions.
• Record counts from Z_PRIMARYKEY: The Core Data Z_PRIMARYKEY table's Z_MAX column reflects the highest primary key value ever assigned for each entity type. This acts as a lower bound on the total number of messages or sessions ever created, regardless of how many remain in the active tables.

Deleted Message Recovery

SQLite does not immediately overwrite freed pages when rows are deleted. WhatsApp message text, JIDs, and other string data may persist in SQLite free pages after deletion. The ChatSearch.sqlite FTS index may also retain indexed text from deleted messages. See Deleted Messages for recovery techniques.

Tool Support

References

• Research: WhatsApp Desktop macOS Artifacts
• Mysk Security Research — WhatsApp Group Container Exposure (July 2024)
• WhatsApp Security — End-to-End Encryption Overview
• Apple Core Data Programming Guide — Persistent Store Types
• XMPP JID Format (RFC 7622)