ORadb backup com.whatsapp and extract the key from the .ab file; I have extracted the key and found out that it's the same for all my devices (I always tested with the same phone number). For the decryption and restoring of the locally saved msgstore.db.crypt12 (like described above), it is also automatically saved on WhatsApp servers. Goto the given file path: sdcard/WhatsApp/Databases Change the name of the backup file you need to restore from msgstore-YYYY-MM-DD.1.db.crypt12 to msgstore.db.crypt12. No need to change the number of the crypt extension. Displayand read chat logs from the WhatsApp mobile application on a personal computer. The utility accesses the Android and extracts logs from crypt5, crypt7, crypt8, and crypt12 versions of the database. Creating a local offline copy of a chat is possible. WhatsApp Viewer 1.9 is free to download from our software library. The WhatsAppis a very popular application in social networks but sometimes it is challenging for digital forensic investigators to decrypt WhatsApp databases from Android devices. An Android device stores a database file named msgstore.db.crypt12 that is encrypted by WhatsApp. Navigateto outside WhatsApp Databases Folder and paste msgstore.db.crypt12 File. Note: Paste the Backup File to the Root of SD Card or Device Storage. 6.Next, connect your Phone to computer. 7. On your computer, navigate to Phone > Card/Device and copy msgstore.db.crypt12 file to Desktop. The above file (msgstore.db.crypt12) contains the WhatsappViewer merupakan aplikasi pihak ketiga dari developer yang sengaja dirancang untuk men-decrypt pesan whatsapp yang sebelumnya ter-encrypt menggunakan crypt12. Jika kita amati, maka file database pesan Whatsapp yang ada pada ponsel android kita terenkripsi dengan kunci crypt12. bisa kita lihat pada path di Internal Storage yaitu . WhatsApp Crypt14 Database Decrypter Decrypts WhatsApp files, given the key file. The output result is a SQLite database that you can read. This is the only thing this script does. Those who are looking for a complete suite for WhatsApp foresincs, check out whapa Version is here! Since the file format keeps changing, I decided to completely reimplement the script. It should be much more efficient and "future proof" now, as it tries to automatically find the various offsets instead of just failing, does not create a temp file and does not load the encrypted DB in memory. It still needs improvements, but it is ready for release Where do I get the key? On rooted Android, you can read /data/data/ Is it not our job to tell you how to get the key file. Support will not given for this. Last tested version don't expect this to be updated Stable Beta Not working / crash / etc Please open an issue and attach Output of the program both with and without force Hexdump of keyfile without the last 32 bytes Hexdump of first 512 bytes of encrypted DB Please also report if your offsets are too far +-5 from the default ones, which are t1 offset 15 IV offset 67 Data offset 190 or 191 Changing the defaults makes the program more efficient. To do / planned Code reorganization single file or more files? Code refactoring Better parse unknown fields of DB and marriage key of keyfile Not planned / wontfix Support for encrypting supporting older encryption formats Usage [-h] [-f] [keyfile] [encrypted] [decrypted] Decrypts WhatsApp files positional arguments keyfile The WhatsApp keyfile encrypted The encrypted crypt14 database decrypted The decrypted database options -h, -help show this help message and exit -f, -force Skip safety checks If decrypt fails and you use -force, the program will 99% just spit more errors and crash. However, trying does not cost anything. Requirements Python developed with pycriptodome Use python -m pip install -r Or python -m pip install pycryptodome Credits Authors TripCode & ElDavoo & DjEdu28 I had a problem almost similar to can only read " OR " The other databases dates should be formatted to " databases with dates are databases which is for backup Every 4am.They backup only for 7 not worry,they contain the same is just incase your current is corrupted,you can change the other 7 from " to " Read more on Whatsapp FAQ Source Or if you want to read directly from here Summary WhatsApp automatically backs up your chats every night. You can initiate a restoration by simply uninstalling and reinstalling WhatsApp. Click Restore when prompted to restore your message history. Your missing chats should appear in WhatsApp! Details WhatsApp automatically makes backups every day at 4 AM and stores them in the WhatsApp folder of your Android phone. This folder is either located in your device's internal memory or external microSD card. To restore the most recent backup, you will need to uninstall and reinstall WhatsApp. If you need to restore older messages, check out "Restoring older less recent backups". During the installation process, you will be prompted to restore your message history. Choose Restore to restore your missing chats. If you are not prompted to restore your messages, it could be that Your SD card and/or chat history is corrupted. Your backup is too old. WhatsApp cannot restore backups that are too old. You have a different phone number than when you backed up your chats. In any of these cases, there is no way for us to restore the messages for you. Restoring older less recent backups Before attempting to restore messages, please note Current chat history will be lost upon restoration. There are only up to 7 days worth of backup files. Any new messages sent/received after a backup, and deleted before the next backup, cannot be restored. If you run a manual backup, it will overwrite the most recent automatic backup file. On newer devices, your WhatsApp/Databases folder is most likely located in your device's internal memory. You must have the same phone number in WhatsApp that you had when you backed up your chats. We also recommend Make sure you have a file manager. This will be useful for renaming the backup files. Here are some choices File Managers and Explorers. If you do not want to lose your current history newest messages, create a manual backup by going to WhatsApp > Menu Button > Settings > Chat Settings > Back up chats. This manual backup file will be saved as " or " in your /sdcard/WhatsApp/Databases folder. Save this file as " or " depending on the original file extension so you do not get it confused with other backup files during the restoration process. Please note your backup files are saved in the /sdcard/WhatsApp/Databases folder. This folder may be located in either your device's internal memory or external memory. To restore from a backup, follow these steps WhatsApp. which backup file you want to restore. that file from " to " or from " to " WhatsApp. asked to restore, tap Restore. You will now be able to see your restored messages. If you want to revert the restoration, simply change the backup filename back to what it was, rename " to " or " to " and follow these steps again. Cheers, WhatsApp Support Team These are just database backups. WhatsApp generates a backup and stores it to the WhatsApp folder on your storage. See the WhatsApp FAQ Your phone will store up to the last seven days worth of local backup files. Local backups will be automatically created every day at 200 AM and saved as a file in your phone. Thereafter, if you have enabled backup to cloud, WhatsApp will also upload a copy of this backup to the Google Drive. If at some point you need to re-install WhatsApp, the app will restore your messages and data from these backup files. Now coming to the list of databases that you see, notice the date in each of the database files, except the first. Every night when a new backup is generated, it is saved as The backup from the last day is renamed with a date in the name. WhatsApp keeps a backup of 7 days + the current main backup. It keeps on deleting the older backup files as new ones are generated every night. You can delete them all and that will have no issues on the functionality of your WhatsApp app. That said, it is kinda useless to delete as new ones will again be generated every night and within a week you'll once again have these 7 files saved in your phone's storage. And as of now, WhatsApp does not give you an option to choose how many backup files to keep. Your deleted WhatsApp messages aren’t necessarily gone forever Picture GettyWhatsApp has made a number of changes to its messaging service over the past few months, including most recently, the ability to edit messages, up to 15 minutes after they have been sent. This can save you the embarrassment of making an unfortunate typo or of accidentally messaging the wrong person. WhatsApp users also now have the power to delete messages which can leave the recipient frustrated and dying to know what was in the deleted message. However, there are a number of simple tricks that iOS and Android users can use to uncover these messages – here’s how. Delete the iOS app iOS users can delete and redownload the WhatsApp app to recover deleted messages. Make sure your WhatsApp messages are backed up on iCloud Make sure your WhatsApp messages are backed up on iCloud Delete WhatsApp from your phone Redownload the app via the App Store Sign back in to your account A message will appear asking if you want previously backed up messages to be restored. If you select this option, all messages will be restored, including deleted ones. WhatsApp users can delete messages after sending them Picture WhatsAppView notification history on Android If you have Android 11 and above you can view messages deleted by the sender using the Notification History feature. Head to settings’ on your smartphone and select apps and notifications’. Find the notifications’ option and then select use notification history. You will then be shown a log of all notifications received by the device, which will include messages sent to you via WhatsApp which were then deleted by the sender. To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video Restore WhatsApp database on Android An alternative method for Android users is to restore WhatsApp messages through a database. Launch the file browser on your device. Head to the WhatsApp folder and click on database’ where all of the locally saved backup files for the app will be located. Hold down the file and then hit edit name’. Change its name to’msgstore to ensure that it is not overwritten. Then, change the most recent backup file’s name to’ Next, open Google Drive on your phone and choose the menu option with three vertical lines on the upper right hand side. Click on backups’ and erase your WhatsApp backup. Then, delete the WhatsApp app and install it again. You will be prompted to recover WhatsApp through a local backup. Choose the file and click Restore – this will restore all messages, even ones that have been deleted by the sender. MORE WhatsApp will now let you edit messages – but there’s a catch MORE WhatsApp’s Chat Lock feature is more than an upgrade for cheaters Follow Metro across our social channels, on Facebook, Twitter and Instagram Share your views in the comments below WhatsApp backup conversation files are now saved with the .crypt12 extension. From crypt9, they seem to be using a modified version of Spongy Castle – a cryptography API library for the findings below are based on reverse engineering work done on WhatCrypt and Omni-Crypt. I would like to highlight that IGLogger proved to be a very useful tool when it came to smali code debugging. Extract Key File To decrypt the crypt12 files, you will first need the key file. The key file stores the encryption key, K. WhatsApp stores the key file in a secure location /data/data/ If your phone is rooted, extracting this file is easy. I will not go through the steps again, as it’s already mentioned in the crypt8 decryption article. If your phone is not rooted, refer to instructions from WhatCrypt and Omni-Crypt for details on extracting the key file. The idea is to install an older version of WhatsApp, where Android ADB backup was still working and extract the key file from the backup. Extract crypt12 Backup File Pull the encrypted WhatsApp messages file from your phone using ADB. $ adb pull /sdcard/WhatsApp/Databases/ Decryption Keys This section is just for your information and you can skip this section. The encryption method being used is AES with a key K length of 256 bits and an initialisation vector IV size of 128 bits. The 256-bit AES key is saved from offset 0x7E till 0x9D in the file. Offsets start from 0x00. You can extract the AES key with hexdump and assign the value to variable $k. $ k=$hexdump -ve '2/1 "%02x"' key cut -b 253-316 The $k variable will hold a 64-digit hexadecimal value in ASCII that is actually 256 bits in length. The IV or the initialisation vector is saved from offset 0x33 till 0x42 in the crypt12 file. The IV value will be different for every crypt12 file. $ iv=$hexdump -n 67 -ve '2/1 "%02x"' cut -b 103-134 The K and IV extraction method is similar to what we have done for crypt8 files before. Strip Header / Footer in crypt12 File Again, this section is just for your information and you can skip this section. Before we start the decryption process, we will need to strip the 67 byte header and 20 byte footer from the crypt12 file. $ dd if= of= ibs=67 skip=1$ truncate -s -20 The above dd command will strip the the first 67 bytes from the crypt12 file and save it to a file with extension The truncate command will strip the last 20 bytes from the crypt12 file. As the WhatsApp AES cryptography API library seems to be a modified version, we will no longer be able to use openssl to decrypt the crypt12 file. I have yet to determine what has been modified. To decrypt crypt12 files, I have written a simple Java program that will use the modified cryptography API library instead. For the cryptography API library, I have extracted the modified Spongy Castle cryptography class files from the Omni-Crypt APK file using dex2jar. You can find the Java program and crypto library over here at GitLab. The Java program will create 3 output files – encrypted file with header and footer stripped. – decrypted file in zlib format. – decrypted sqlite3 database file. Below is how you can compile and run the Java program. 12345678910111213141516171819202122232425262728293031323334353637383940 $ git clone cd whatsapp-crypt12/$ javac -classpath "lib/ cp ../ .$ cp ../ .$ java -cp "lib/ crypt12KXXXXXXXXXXIVYYYYcreating encrypted file with header/footer stripped zlib output file sqlite3 output file ls -ltotal 136724-rw-r-r- 1 ibrahim staff 4339 Oct 9 1605 1 ibrahim staff 5459 Oct 9 1605 1 ibrahim staff 158 Oct 9 1605 keydrwxr-xr-x 2 ibrahim staff 4096 Oct 9 1605 lib-rw-r-r- 1 ibrahim staff 1089 Oct 9 1605 LICENSE-rw-r-r- 1 ibrahim staff 62692352 Oct 9 1606 1 ibrahim staff 25757610 Oct 9 1605 1 ibrahim staff 25757523 Oct 9 1605 1 ibrahim staff 25757507 Oct 9 1606 1 ibrahim staff 1376 Oct 9 1605 file * compiled Java class data, version Java C source, ASCII textkey Java serialization data, version 5lib SQLite database, user version raw G3 data, zlib compressed data Final Words To use the Java decryption tool, you will need to use OpenJDK. Oracle require JCE Provider libraries to be signed. OpenJDK does not have this requirement. If you try running the Java program on Oracle JDK, you will most likely get the following exception. Exception in thread "main" JCE cannot authenticate the provider SC There are some workarounds to bypass the error, but it has not worked for me so far. Decryption failed when using the modified cryptography API library from WhatsApp and WhatCrypt. Only Omni-Crypt library is working. I have yet to determine the reason for this. If you have any further information on this, leave a = { interested_inunix, linux, android, open_source, reverse_engineering; codingc, shell, php, python, java, javascript, nodejs, react; plays_onxbox, ps4; linux_desktop_usertrue; } As Ashesh mentioned you can use the tool on the XDA developer website [TOOL] Whatsapp Xtract Backup Messages Extractor / Database Analyzer / Chat-Backup Alternatively you can do this manually as follows The WhatsApp Database is stored unencrypted at this path on the Android device /data/data/ Backups of the database are also stored encrypted on the SD card typically at the following location /sdcard/WhatsApp/Databases/ The unique key for the encrypted backup databases is stored here /data/data/ Access to the /data/data directory requires root access. Alternatively ADB Android Debug Bridge can be used to extract the above files after booting into recovery on the device. How to Decrypt WhatsApp crypt7 Database Messages commands below are run from a linux enviroment Extract Key File /data/data/ Extract crypt7 file /sdcard/WhatsApp/Databases/ Extract Decryption Keys from "key" file extracted in step 1 256-bit AES key hexdump -e '2/1 "%02x"' key cut -b 253-316 > IV initialisation vector hexdump -e '2/1 "%02x"' key cut -b 221-252 > Strip Header in crypt7 File dd if= of= ibs=67 skip=1 Note Size of header stripped file in bytes must be divisible by 16 Decrypt crypt7 File openssl enc -aes-256-cbc -d -nosalt -nopad -bufsize 16384 -in -K $cat -iv $cat >

whatsapp database msgstore db crypt12