WHATSAPP IN INVESTIGATIONS

Review WhatsApp
like WhatsApp.

Every chat on the phone in a rail on the left, the whole conversation on the right — the interface every investigator already knows. Not a pile of per-day documents.

Whole conversations

Read a chat as it happened, end to end. Traditional tools hand you one document per day and leave the stitching to you.

Every chat, one rail

All the conversations on a device, searchable, with hit counts — pick one and you are in it.

Deletions, with provenance

Certified by the extraction, claimed by the app, or absent. Each recorded as itself.

The familiar interface

Pick a chat, read it whole
Participants, replies, media and voice notes, in order, across every day it ran.
Search lands you in context
You arrive on the message with the exchange around it intact. Images inside chats are OCR’d.
Day slices, one click away
The day-slice stays the coded unit — defensible and countable — and reviewers can switch to it at any time.

Built for forensic extractions

Cellebrite UFDR, Android
Decoded chats straight from the report — identifiers, device timestamps, participants, recoverable deleted rows.
iPhone extractions
The WhatsApp database as the device stored it: every message type, media, voice notes, reactions, deletions.
Never a screenshot pile
Provenance travels with every message, so the exhibit is the extraction — not someone’s retyping of it.

Can you recover deleted WhatsApp messages?

Certified deleted. The forensic tool found the row in the device database. The text usually survives.

Claimed deleted. The app’s own tombstone: the sender recalled it. The marker never says what it said.

Absent. The unmarked messages: nothing in the extraction says they were deleted, and the record says so.

Every state travels with the message — through search, tagging, batching and export — so what you put in front of a tribunal says exactly what the source supports.

What survives a courtroom

Provenance
Which device or account, produced by whom, when, with what.
Integrity
A hash at ingestion: the exhibit is provably the item collected.
Completeness
What the artefact covers, on the record.
An auditable review
Who looked at what, and what they decided.
Reproducibility
The same source yields the same output, so an opponent can follow it.

How Kendraa handles it

Ingestion
Cellebrite UFDR and iPhone extractions, with media, voice notes and deleted rows.
Reconstruction
Participants, timestamps, replies, attachments and voice notes, rebuilt into conversations.
Search
Plain English across chats and documents. No query syntax, no operator.
Deployment
Your own AWS account, in India. The AI runs in the same environment.

See the security posture, or write to us about an artefact you are stuck on.