I have aa WhatsApp ChatStorage.sqlite file which was taken from an iPhone backup, and I don't exactly understand the structure of the data inside the database, but it's clearly not encrypted. I want to use this file to "restore" the messages it contains into a newer Android phone. From what I know the current format WhatsApp uses to store message databases is .db.crypt8 which I assume is the same SQLite DB, only encrypted (but I may be wrong). WhatsApp (2.12.317) on Android (5.0) doesn't seem to "recognize" the plain .sqlite file as a backed up DB on first setup. Is there a way to make it accept the file as a message backup? Can I somehow encrypt the DB file in the format it is expecting to receive?
Ok... at home now.
Don't know if you run unix variant or something else... That doesn't really but all these scripts have been run under Linux.
create iphone backup (http://libimobiledevice.org)
Reading the backup
git clone https://github.com/PicciMario/iPhone-Backup-Analyzer-2
then modify main.py on line 1449
-database = sqlite3.connect(':memory:') # Create a database file in memory
+database = sqlite3.connect('/tmp/md.db') # Create a database file in memory
then just start program and let it parse Manifest.mbdb of the iphone backup
parse /tmp/md.db and extract names of whatsapp files and media
SQLite version 188.8.131.52 2015-05-20 18:17:19
Enter ".help" for usage hints.
sqlite> .mode csv
sqlite> .separator | \n
sqlite> .output files2.csv
sqlite> .headers on
sqlite> select fileid,domain_type,domain,file_path,file_name from indice where domain = "net.whatsapp.WhatsApp" AND domain_type = "AppDomain";
sqlite> .out stdout
copy files and correct their names (just replace with your UUID):
foreach i (
cat files2.csv | grep Library/Media/ | grep '""' | sed "s/|\"\".\+$//g" | cut -d "|" -f 2- | sed "s/|/\//g");do;mkdir -p /tmp/extracted/$i;done
foreach i (
cat files2.csv | grep Library/Media/ | grep -v '""' | sed "s/|/\//g" | sed "s/\/AppDomain/|AppDomain/");do;src=
echo $i | cut -d "|" -f 1;dst=
echo $i | cut -d "|" -f 2 | sed "s/.$//g" ; cp -v /Path/to/iphone/backup/UUID/0ef862e6faede9b72c75b948f8b5c9663921e796/$src /tmp/extracted/$dst;done
cp 0ef862e6faede9b72c75b948f8b5c9663921e796/ec50dd986a0f35953e40f6ca9602ad78173e254f /tmp/extracted/Contacts.sqlite
cp 0ef862e6faede9b72c75b948f8b5c9663921e796/7c7fba66680ef796b916b067077cc246adacf01d /tmp/extracted/ChatStorage.sqlite
Now you have your whatsapp media and ChatStorage.sqlite
install adb (from Android-sdk-update-manager) http://developer.android.com/sdk/
On android install WhatsApp, become debugger and enable usb debugging. Setup WhatsApp and send at least one message and click backup in whatsapp. Download Legacy whatsapp and possibly also current one:
adb install -r -d LegacyWhatsApp.apk
backup whatsapp (http://www.digitalinternals.com/security/).
This is the only phase the legacy version needs to be installed:
adb backup -f whatsapp.ab -noapk com.whatsapp
Extract key (http://www.digitalinternals.com/security/decrypt-whatsapp-crypt8-database-messages/419/):
dd if=whatsapp.ab bs=4096 skip=24 iflag=skip_bytes | openssl zlib -d > whatsapp.tar
tar xvf whatsapp.tar apps/com.whatsapp/db/msgstore.db apps/com.whatsapp/f/key k=$(hexdump -ve '2/1 "%02x"' apps/com.whatsapp/f/key | cut -b 253-316)
Pull whatsapp message backup
adb pull /sdcard/WhatsApp/Database/msgstore.db.crypt8 msgstore.db.crypt8
iv=$(hexdump -n 67 -ve '2/1 "%02x"' msgstore.db.crypt8 | cut -b 103-134);dd if=msgstore.db.crypt8 bs=4096 skip=67 iflag=skip_bytes | openssl enc -aes-256-cbc -d -nosalt -bufsize 16384 -K $k -iv $iv | gunzip > msgstore.db
merge databases (https://gist.github.com/paracycle/6107205). The script provided here is not complete and trou reading multiple forensicsites I now know how to modify, to get your media also... but that is work in progress
sqlite3 -init ../convert.sql ../merged.db
dd if=msgstore.db.crypt8 iflag=count_bytes count=67 of=msgstore.db.crypt8; cat merged.db | gzip -5 |openssl enc -aes-256-cbc -e -nosalt -bufsize 16384 -K $k -iv $iv | dd of=msgstore.db.crypt8 bs=4096 seek=67 oflag=seek_bytes conv=notrunc
Push new backup:
adb push msgstore.db.crypt8 /sdcard/WhatsApp/Databases/
Push current version back to android and start whatsapp to read the backup:
adb install -r -d WhatsApp.apk
Well I've been doing the same thing for 2 days. It was relative simple. I have still not figured out how to include media.
Software you need:
Openssl Adb (android debug bridge) Sqlite3 legacy version whatsapp +common unix tools
The work flow is like this:
Extract all media from iPhone backup. Filenames are hashed and indexes are in Manifest.mbdb and can be ten just copyed to right locations. With adb install legacy version of WhatsApp and retrieve key from android with adb backup. Uninstall legacy whatsapp. With adb download msgstore.db.crypt8 from android. Strip header and iv and decrypt with key and iv using openssl. Then gunzip and you have the msgstore.db
Merge msgstore.db with chatstorage.sqlite with standard SQL commands.
Gzip and encrypt msgstore.db using the same key and any iv. Store the header + the iv and the encrypted data in a file concatenated together and named msgstore.db.crypt8. Move the file to android /sdcard/WhatsApp/Database/ with adb and install WhatsApp.
I can I've you the sources but not at home rigth now.. So will do it later...