How rahimgujjar/whatsapp-wal-xray works
WAL-XRay is a command-line client-side forensic suite for examining WhatsApp SQLite WAL data. Its primary workflow accepts a user-supplied WAL and decryption key, parses and decrypts records, maps them to message and media telemetry, and stores extracted records locally. Separate tools support schema discovery, event filtering, privacy sanitization, endpoint and payload inspection, and media carving. The README describes these capabilities, while sampled source confirms only some of their wiring; independent tools are therefore shown as separate workflows where connections are not established.
Main entry points: wal_forensic_parser.py WAL parser · wal_universal_mapper.py Schema mapper · wal_check_header.py Header auditor · wal_io_latency_tester.py I/O latency monitor
Components 17
Forensic Engine
- WAL parser
core-engine/wal_forensic_parser.py - Forensic database
core-engine/wal_forensic_parser.py
WAL Discovery
- Schema mapper
diagnostic-tools/wal_universal_mapper.py - Header auditor
diagnostic-tools/wal_check_header.py - I/O latency monitor
diagnostic-tools/wal_io_latency_tester.py
Data Sanitization
- Event filter
diagnostic-tools/remove_events.py - PII and duplicate cleaner
data-privacy-compliance/log_cleaner.py - PII pseudonymizer
data-privacy-compliance/replace_global_pii.py
Telemetry Inspection
- Pattern classifier
diagnostic-tools/wal_pattern_finder.py - Endpoint scanner
diagnostic-tools/wal_debug_cols.py - Column auditor
diagnostic-tools/wal_inspect_col_ranges.py - Media carver
diagnostic-tools/thumbnail_extract.py
Other components
- Analyst
- WAL file
- AES key
- Telemetry log
- Hex payload
Connections 24
- Analyst → WAL parser: runs with
- WAL file → WAL parser: reads WAL
- AES key → WAL parser: decrypts with
- WAL parser → Forensic database: writes records
- Analyst → Schema mapper: runs on WAL
- WAL file → Schema mapper: maps structure
- Analyst → Header auditor: checks WAL
- WAL file → Header auditor: reads header
- Analyst → I/O latency monitor: starts monitor
- WAL file → I/O latency monitor: measures I/O
- Analyst → Event filter: filters log
- Telemetry log → Event filter: reads events
- Analyst → PII and duplicate cleaner: cleans log
- Telemetry log → PII and duplicate cleaner: reads events
- Analyst → PII pseudonymizer: pseudonymizes log
- Telemetry log → PII pseudonymizer: reads text
- Analyst → Pattern classifier: classifies log
- Telemetry log → Pattern classifier: scans entries
- Analyst → Endpoint scanner: inspects log
- Telemetry log → Endpoint scanner: scans columns
- Analyst → Column auditor: audits columns
- Telemetry log → Column auditor: reads blocks
- Analyst → Media carver: carves payload
- Hex payload → Media carver: decodes hex