Case Study: Investigating WhatsApp Desktop Activity on Windows with Belkasoft X
WhatsApp left traces on a Windows computer. But what could those traces actually reveal about how the application was used?
In this case study, forensic examiner Karl Norris of DUOLARK LLC used Belkasoft X to uncover evidence of multiple WhatsApp installations. These findings led him to locally stored application data, where further analysis and evidence correlation helped establish what the available records could—and could not—prove.
Discover how a handful of Windows artifacts became the starting point for a deeper forensic investigation.
Case study summary
An unlocked mobile phone and a computer drive forensic image contained evidence that WhatsApp was installed and used, but it was not presented as a straightforward conversation report. DUOLARK used Belkasoft Evidence Center X to examine the image, follow the relevant system and application evidence, and preserve the material requiring closer review. Database analysis and forensic correlation then converted technical artifacts into findings attorneys, investigators, and other decision makers could understand.
Confidentiality: The matter was an authorized forensic examination. Client identities, communications, investigative terms, and proprietary examination procedures have been omitted or generalized.
The question behind the case
The assignment began with a straightforward question: had WhatsApp been used on the computer, and did the available evidence contain information relevant to the investigation?
A question like that rarely arrives with a convenient answer. A forensic image does not open like an ordinary computer, and communications are not always presented as a readable transcript. Applications change over time. Multiple versions may have existed on the same device. Automated processing may identify the program without resolving the underlying investigative question.
For a counsel, an insurer, or a business decision maker, the distinction matters. Finding a program is not the same as proving it ran. Proving that it ran is not the same as establishing that a particular communication existed. Each conclusion requires evidence appropriate to that conclusion.
What Belkasoft X revealed
DUOLARK created, processed, and examined an E01 forensic image using Belkasoft X. The initial review identified evidence associated with more than one WhatsApp installation. Amcache evidence supported the presence of a standalone installation, while Prefetch evidence established execution associated with the Microsoft Store version.
The evidence did more than establish execution of the application. It identified the application resources involved when WhatsApp operated and directed the examination toward the locally retained data associated with the active installation.
This became the turning point. The investigation moved from asking whether WhatsApp was present to examine what the application evidence could reliably establish.
Why the standard view was not enough
Belkasoft X provided the forensic visibility needed to work through the image and reach the relevant evidence. The remaining challenge was interpretive. The information was structured for an application, not for an attorney, claims professional, investigator, or jury.
The records had to be examined in context. Communications, participants, conversation relationships, media references, timing information, and application activity could not be treated as isolated facts. A technically valid result could still be misleading if an identifier were assigned to the wrong person, an application timestamp was interpreted incorrectly, or program execution was described as proof of a particular message.
DUOLARK applied database experience and investigative judgment to connect the relevant information, test the relationships, and separate confirmed evidence from inference. The objective was not to produce the largest volume of artifacts. It was to answer the assignment accurately.
The workmanship behind the finding
Good forensic work is often defined by what the examiner refuses to assume. In this examination:
- Application installation was not reported as proof of communication.
- Application execution was established independently before it was relied upon.
- Technical identifiers were not attributed to people without supporting evidence.
- Dates and times were evaluated according to their actual source and context.
- Locally available records were considered together rather than reported as disconnected artifacts.
- Limitations were preserved rather than replaced with certainty the evidence could not support.
These decisions are not dramatic, but they are what make a finding defensible. A report prepared for litigation must survive questions that do not arise during an ordinary technical review: Where did the information come from? What does it prove? What does it not prove? Could another interpretation fit the evidence?
The investigative result
The examination progressed beyond evidence of installation and execution. The investigation identified, correlated, and documented information relevant to the assignment from locally available WhatsApp application evidence. The resulting report explained the findings in plain language while retaining the technical foundation needed for review.
The report did not claim every historical conversation or deleted item could be recovered. Results in WhatsApp examinations depend on the device, acquisition method, application version, encryption, synchronization, retention, and condition of the available data. The conclusion was limited to what this evidence supported.
Restraint was part of the result. The client received an answer that could be used responsibly, not a technical possibility presented as a proven fact.
Why this matters beyond one case
Digital evidence increasingly appears in civil litigation, insurance claims, internal investigations, fraud matters, employment disputes, and incident response. The person evaluating the matter may know that communications are important without knowing how an application stores or presents them. That should not require the client to become a digital-forensics specialist.
The client needs an examiner who can translate between the evidence and the decision. Attorneys need to know whether a finding is supported and can be explained. Insurers need to understand what happened, what remains uncertain, and whether further work is proportionate. Cybersecurity leaders need findings that can guide response without confusing system activity with human action.
A forensic platform is essential, but the platform and the examiner serve different functions. Belkasoft X enabled us to examine the image, navigate the evidence, and work with the relevant artifacts. DUOLARK supplied investigative direction, database experience, validation, and reporting needed to turn those artifacts into an answer.
Belkasoft X in practice
DUOLARK uses Belkasoft X in active forensic matters involving computers, mobile devices, forensic images, cloud environments, application data, and other digital evidence. The platform's practical use informs how DUOLARK evaluates investigative needs, plans examinations, and communicates results.
DUOLARK also resells and supports Belkasoft forensic solutions to law-enforcement agencies, investigative organizations, forensic laboratories, legal-service providers, and qualified private-sector organizations. This lets prospective purchasers speak with a practitioner who uses the product in real engagements and understands the difference between acquiring a forensic capability and applying it effectively.
When to contact DUOLARK
DUOLARK assists when key evidence is present, but the answer isn't immediately visible. That may occur when:
- A forensic image has been acquired, but the investigation has stalled at artifact review.
- An application was identified, but its actual use or evidentiary significance remains unresolved.
- Communications or application records require specialized database interpretation.
- Technical findings must be converted into a report suitable for counsel, an insurer, a client, or a court.
- An investigator or forensic examiner needs focused assistance with a difficult portion of a larger matter.
DUOLARK provides digital forensics, litigation support, cyber investigations, expert-witness services, cybersecurity, and incident response. Each engagement begins with the evidence and the question to be answered. The scope can range from a focused second-level examination to a complete forensic investigation and report.
Bring your investigative challenge to DUOLARK
If your organization is facing a similar investigative challenge, or if you have questions about whether this type of examination may apply to your matter, contact DUOLARK to discuss the available evidence and appropriate next steps. As an authorized Belkasoft partner that uses Belkasoft X in active forensic engagements, DUOLARK can also assist organizations to conduct examinations, support an existing investigative team, or evaluate and acquire Belkasoft technology for their own investigative needs.
About Karl Norris and DUOLARK
Karl Norris is the Founder and Principal Forensic Examiner of DUOLARK LLC. His work spans digital forensics, cyber investigations, litigation support, database analysis, and incident response. He has qualified under the Daubert standard and provided testimony in more than 50 federal and state matters. He is also a keynote speaker and mentor.
Learn more at duolark.io and duolark.com.