So the first thing you need to think about
is, how is the data secure?
Is it end-to-end encryption?
Is the data even saved on the device?
If it is, is the database encrypted?
Or is data simply encoded a certain way within a database?
Is the data protected at all?
Are encryption keys stored on the device?
So something that you'll see a lot now,
if you get a full file system extraction,
often, the key chains are extracted from these devices.
They may actually have the decryption key for things
like WhatsApp, or Signal, or Telegram,
and when parsed together, be able to show you that data.
If you cannot retrieve data from these applications,
don't forget to think about attachments.
Don't forget to think about audio files.
And don't overlook other databases.
The biggest issue I think people hit
is they go to where they think the chat message
database is going to be, and it's encrypted, and they stop.
Be smarter than that.
Have some drive that leads you down a path
to uncover additional information.