Digital forensics is now being used to help expose cybercrimes and unlawful activity. WhatsApp is one of the most used applications at the core of cases for digital evidence, like messages, media, and other related data. This research proposed a comprehensive framework for metadata analysis of recovered deleted WhatsApp files on Windows platforms. The initial phase of the process is data acquisition. During this phase, forensic tools such as FTK Imager and Autopsy extract data from Windows WhatsApp while maintaining the integrity of the data and preserving relevant information, including multimedia, messages, and databases. The subsequent phase involves metadata extraction, where key metadata is retrieved to assist in reconstructing the sequence of events. This is followed by the metadata analysis phase, which employs ExifTool metadata analysis tools and machine learning techniques. Following the analysis, data visualization is conducted using Python to effectively present the findings. The process concludes with a comprehensive review phase, in which all aspects of the work, from the initial data acquisition to the final analysis, are thoroughly evaluated. This framework focuses on recovering deleted files and primarily relies on using file carving techniques to recover deleted WhatsApp files from unallocated disk space if they are partially overwritten and helps investigators to trace, aggregate, and produce comprehensible reports for legal proceedings so that WhatsApp forensic investigations should be precise and reliable for use in criminal and civil cases.