Evidence: WhatsApp Desktop Cache
Description: Collect WhatsApp Desktop Cache
Category: Applications
Platform: windows
Short Name: whtc
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
WhatsApp Desktop stores cached images, media, and web content in cache directories. These files include profile pictures, shared images, videos, and other media exchanged in conversations.
Data Collected
This collector gathers structured data about whatsapp desktop cache.
Collection Method
This collector gathers WhatsApp cache directories from app packages and Roaming directories, collecting cached media and web content.
Forensic Value
WhatsApp cache contains visual evidence from conversations including shared images, profile pictures, and media files. This helps recover deleted content, identify participants, and understand the context of communications in investigations.
