Just like there are common GPS applications, there are also several easily identified chat applications that are heavily utilized. The more common the application, the better the tool support tends to be. WhatsApp, a common WIFI chat application, has made several changes to its user data storage model, which has made it a little more difficult to crack. A database file is often accompanied by a .bak file that must be parsed for content. In newer versions, the .bak is followed by a .crypto extension, and this has posed a challenge to some mobile tool vendors.

Snapchat, the application that rose to popularity by offering the complete elimination of any photo sent via a message from the device, can also be examined for user data that is still retained by the device. Usernames/passwords and profile pictures have all been successfully recovered from iOS devices.

Cellebrite and XRY pay special attention to chats that take place through the Facebook application. Their method of choice for displaying the information to the user is to list it under chats with a distinction to reference the originating application.

Just like GPS applications, there are some applications designed for one use and can be adversely utilized for another. Words With Friends by Zynga is a popular game similar to Scrabble. The game allows for chats to take place between players, all while making moves on the virtual board. Because Words With Friends isn’t categorized as a chat application, its chat logs are not parsed and presented to the user under the chat listing. Another rather misleading piece of the Words With Friends puzzle is that the user data is stored in a database file that doesn’t necessarily describe the application or its functionality. In iOS devices, you may come across Words With Friends data in the Chess Database file.