Deleted is not gone.
ChatTrace Forensics gives investigators a structured, repeatable framework for recovering and analysing deleted WhatsApp media on Windows computers, turning lost files into documented evidence.
The problem
Messaging apps hold critical evidence, and desktop traces are overlooked.
WhatsApp is used for messaging, calls and file sharing on Android, iOS, the web and Windows. That popularity makes it a frequent part of criminal investigations, yet existing forensic research is limited and focuses mostly on mobile phones, leaving deleted media on desktop computers under-examined.
people use WhatsApp worldwide.
the year WhatsApp launched; it was acquired in 2014 and expanded to desktop.
platforms where WhatsApp runs: Android, iOS, web browsers and Windows, the focus of our framework.
Sources: Meta (2020) for the user count; dates and platforms as cited in the founding research paper.
How it works
A forensic workflow built for the courtroom.
Each step is documented so findings are repeatable and defensible.
Acquire
Create a forensically sound copy of the Windows system without altering the original.
Locate
Identify WhatsApp application data and media storage on the desktop.
Recover
Apply the framework's technical methods to restore deleted media artefacts.
Report
Hash, timestamp and document every finding in a clear evidence report.
Product
Purpose-built for Windows messaging forensics.
Validated through a case study built on an experimental crime scenario.
Deleted media recovery
Focused on images, videos, audio and documents removed from WhatsApp on Windows.
Chain of custody
Hashing and logging at every step to keep evidence admissible.
Legal-ready reports
Clear output designed for investigators, lawyers and courts.
Repeatable method
A documented methodology that other examiners can follow and verify.
Who it's for
For people who need the truth from a computer.
Law enforcement
Digital forensics units investigating cases involving messaging apps.
Legal teams
Lawyers and experts who need defensible digital evidence.
Corporate investigations
Internal security and compliance teams handling misconduct cases.
The research
A forensic framework tested on a simulated crime.
- Proposes a forensic analysis framework for deleted WhatsApp media on Windows.
- Addresses a gap: most messaging forensics research focuses on mobile devices.
- Provides a methodology overview with technical solutions for recovering deleted media.
- Evaluated through a case study based on an experimental crime scenario.
Pandey, S., Rahman, R. U., Phulre, A. K., Samara, G., Lamkuche, H. S., & Sbaih, A. H. (2025). Forensic Framework for Deleted Media of WhatsApp on Windows. Studies in Systems, Decision and Control. Springer.
Team
Where digital forensics meets the law.
Founded in 2025 by a student team from two faculties.
Faculty of Engineering & Information Technology
Forensic techniques, data recovery and tool development.
Faculty of Law
Evidence admissibility, chain of custody and legal procedure.
FAQ
Questions we hear often.
Is this tool for personal snooping?
No. ChatTrace is intended for authorised investigations by law enforcement, legal and corporate forensic professionals.
Does it modify the original computer?
No. The framework works on forensically sound copies to preserve evidence integrity.
Which data types can be recovered?
The framework targets deleted media such as images, videos, audio and documents. Recovery depends on the state of the system.
Is it affiliated with WhatsApp?
No. ChatTrace is an independent forensic research project. WhatsApp is a trademark of its owner.
Bring desktop evidence into the investigation.
We work with authorised forensic units and legal professionals on pilot cases and training.