Autopsy plugin to extract artifacts from WhatsApp desktop application on Windows.
- Parses the raw log file created by the application in windows and present it in autopsy.
- Get date and time stamps of each artifact.
Windows:
C:\Users\<username>\AppData\Roaming\WhatsApp\IndexedDB\file__0.indexeddb.leveldb\{#######}.log
Mac:
/Users/<username>/Library/Containers/desktop.WhatsApp/Data/Library/Application Support/WhatsApp/IndexedDB/file__0.indexeddb.leveldb/{######}.log