FussyCraft - Smudla

Recover old WhatsApp Desktop data on Windows

IMPORTANT: Windows 10/11 + WhatsApp Desktop.

This guide covers old Windows installations, VSS shadow copies / restore points, old disks and VHD/VHDX images. It is not an Android, iPhone/iOS or macOS guide.

1. Fast path: Windows VSS / restore point / shadow copy

Windows may retain older point-in-time volume snapshots through Volume Shadow Copy Service (VSS). Windows restore points are captured using VSS. If a surviving snapshot contains the older WhatsApp LocalState, you can copy only the WhatsApp folder without rolling back the whole PC.

Manual Administrator CMD workflow

vssadmin list shadows /for=C:

Choose the timestamp you need and copy its Shadow Copy Volume, for example:

\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23

mkdir C:\SMUDLA_VSS 2>nul
rmdir C:\SMUDLA_VSS 2>nul
mklink /d C:\SMUDLA_VSS "\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy23\"

dir /a C:\SMUDLA_VSS\Users
dir /a "C:\SMUDLA_VSS\Users\Domov\AppData\Local\Packages"

Typical source:

C:\SMUDLA_VSS\Users\Domov\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState

Copy only WhatsApp to K:

robocopy "C:\SMUDLA_VSS\Users\Domov\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState" ^
 "K:\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState" ^
 /E /COPY:DAT /DCOPY:DAT /R:1 /W:1 /XJ

rmdir C:\SMUDLA_VSS

Do not run vssadmin delete shadows.

The customer ZIP also includes EXTRACT_WHATSAPP_FROM_VSS.cmd. It lists snapshots, lets the user choose one, searches it for WhatsApp LocalState, copies only WhatsApp and records snapshot metadata plus SHA-256 hashes.

2. Show hidden AppData, Local and Roaming

Windows 11: File Explorer → View → Show → Hidden items.

Windows 10: File Explorer → View → Hidden items.

C:\Users\YourName\AppData\Local
C:\Users\YourName\AppData\Roaming

%LOCALAPPDATA% and %APPDATA% point to the current Windows profile, not an old mounted disk or VSS snapshot.

3. VHD / VHDX Windows image

Open diskmgmt.msc, choose Action → Attach VHD, preferably read-only, then browse:

K:\Users\<OLD_USER>\AppData\Local\Packages\*WhatsAppDesktop*\LocalState

4. What to give Smudla

Give the complete LocalState folder.

K:\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState
D:\WA_RECOVERY_SOURCE\LocalState

Do not give genericStorage.db alone, session.db alone, the whole drive or the Packages parent directory.

5. Roaming

Older desktop variants may also use AppData\Roaming\WhatsApp. Preserve it too. MAX-FORENSIC is optimized mainly for the Microsoft Store/MSIX LocalState.

6. Output

CHAT_EXPORT\PRESENTABLE_REPORT.html
CHAT_EXPORT\PRESENTABLE_REPORT.txt
CHAT_EXPORT\RECOVERY_OVERVIEW.txt
CHAT_EXPORT\RECOVERED_MESSAGES.csv
CHAT_EXPORT\FTS5_RECOVERED_MESSAGES.csv
CHAT_EXPORT\EVIDENCE_MANIFEST_SHA256.csv

Licensing and prices

Plan	Regular	Promo
1 PC monthly	~~CZK 299~~	CZK 209.30 / month
2 PC monthly	~~CZK 499~~	CZK 349.30 / month
3 PC monthly	~~CZK 649~~	CZK 454.30 / month
4 PC monthly	~~CZK 799~~	CZK 559.30 / month
5 PC monthly	~~CZK 949~~	CZK 664.30 / month
Unlimited monthly	~~CZK 1,490~~	CZK 1,043 / month
1 PC annual	~~CZK 2,490~~	CZK 1,743 / year
2 PC annual	~~CZK 3,990~~	CZK 2,793 / year
3 PC annual	~~CZK 5,290~~	CZK 3,703 / year
4 PC annual	~~CZK 6,490~~	CZK 4,543 / year
5 PC annual	~~CZK 7,490~~	CZK 5,243 / year
Unlimited annual	~~CZK 12,450~~	CZK 8,715 / year
Unlimited PC · perpetual	~~CZK 29,900~~	CZK 20,930 one-time

The perpetual licence has no billing expiry and no recurring charge. It is still verified online by Lajkto on every launch and every new PC is confirmed through the purchase email. It is not transferable between customers.

FussyCraft - Smudla v3.1.9

Portable Python is included. Standard CHATS, CHATS_DEEP, ALL_MESSAGES and RECOVERED_MESSAGES are rendered after contacts.db/UserStatuses/LID-PN correlation. Raw pre-identity outputs remain preserved separately for provenance.