TWRP Backup restoring Line/Whatsapp problem

Question

so I have the following Problem.

I had flashed the custom os anchidroid onto my s3. It was working perfectly until recently my phone would boot and keep trying to optimise all my apps and restart and try to optimise all apps again and so on. So i googled for an answer, and i found a thread saying that its best to reinstall, so I took a twrp nandroid backup of my broken rom and reinstalled.

Now I have the problem that I dont know how to restore my apps from my twrp Backup. I tried titanium backup and Nandroid Manager. Titanium Backup essential doesnt recover my apps. It does list all my apps but when trying to recover data or data plus app it just says batch action complete, but doesnt do anything. Nandroid Manager on the other site keeps crashing when im trying to open the Backup.

I also tried extracting the twrp backup on my desktop and move the files over to my phone, but thats where my essential problem is: Is it normal that the /data/com.whatsapp f.x. is only 228kb? My whole data twrp backup is around 3gb big, with 400mb being dalvik cache and 2gb base apks and the rest being in /data/data

I would be fine with just reinstalling the apps from the google play store and not recovering chat logs, but since whatsapp and line are based on verification with a phone number this is not an option for me. I dont have my phone number to log in.

Last time I had an issue with my phone I was able to use Titanium Backup to backup Whatsapp and Line and restore then on the factory reset rom again and bypass the phone verification, but since I wasnt able to access my phone at all I wasnt able to reproduce this step.

Did I do something wrong when I tried to restore the apps or is there any other Way I could restore them from my twrp backup? Any Help is appreciated.

Im using the Android Version 5.1.1 with ARchidroid 3.1.5

Answer 1

Titanium Backup essential doesnt recover my apps. It does list all my apps but when trying to recover data or data plus app it just says batch action complete, but doesnt do anything

This is wrong in general, because Titanium's duty is to restore snapshots of applications accessing folders that are normally hidden to the regular user. For example I have just successfully restored Authenticator, which is designed to be buried in the phone.

While this works for (many) apps, others may not work with Titanium because of esoteric ways to store their data. Applications heavily depending on cryptography should be implemented in a way that Titanium fails to restore the app state. Not aimed to defeat Titanium, but in such a way that Titanium fails.

The following is an answer from a developer.

I don't have the source code of Whatsapp and Line, but from what I have learned from security-oriented coding and Android docs, you should avoid to store a private key "plaintext" in the store, relying on Android's kernel and hardware features to protect your keys.

One is to use hardware keystore attestation. Since keys are bound to hardware features, a root user copying the secure storage of such applications will fail.

Another is simply to hash the keys with hardware information such as IMEI or Device ID, something that cannot be (easily) cloned by a super user, and that Titanium won't necessarily restore.

I said necessarily because I recall an option, working on the same hardware model, to restore the device ID from the build properties, in order for Google to make it appear as the old device.

Conclusion

I think that Whatsapp and Line's implementation of secure storage relies on hardware information to implement the highest standards in information security, with the direct consequence that a restored dump of the user data directory will necessarily fail.