I've seen some threads about accessing the WhatsApp messages backup database files on iPhone, Android and older Windows Phone versions (7.x). However, none of the methods seem to be compatible with the WhatsApp messages backup database file found on Windows Phone 8.1. I am looking for a way to either extract/decrypt or restore an older messages backup database. Tried so far:
- Place messages.db file on SD card and reinstall WhatsApp. WhatsApp does NOT find the backup on installation. It only restores the most recent chats (not the ones from the backup file)
- Tried available tools for iPhone/Android (Python scripts with crypto 5/7/8). Database format is incompatible
- Tried opening the database file directly in Microsoft Access, SQLite Browser. Unrecognized file format
- Tried the Zune/WP Device Manager approach. Seems to work only with Windows Phone 7.x, Windows Phone 8 is not seen by the tool
- Tried Windows Phone Power Tools to access Isolated Storage for the WhatsApp app, but access to an apps isolated storage is not possible in Windows Phone 8 anymore.
- Tried the WhatsApp Xtractor, but it contains the same iPhone/Android python scripts that don't work with the Windows Phone version
- Even tried asking WhatsApp support directly, but they have not given any response yet
Can any WhatsApp / encryption wizard please help me out. I am more than willing to reward/tip you for it if the solution works!
i have the same problem ,pls pls pls tell me about the solution thx
Given that you already enabled full FS access on your phone or have control over an app wich has the ID_CAP_OEMPUBLICDIRECTORY capability, you can extract the unencrypted sqlite database from C:\Data\SharedData\OEM\Public\WhatsApp.
The structure of the database is quite complex (I suppose it grew over the years), but not too hard to understand.
However, I have no experience in using this mechanism as a backup/restore solution.
Source: blackhat . com/docs/ldn-15/materials/london-15-DeFulgentis-Witchcraft-For-Windows-Phone-Breakers.pdf page 68f
Sorry for broken link, I'm a new member.
I realize this is a pity, I want the Microsoft support seriously and updating applications
If you do not want to unlock / flash your phone in order to enable the full FS unlock, you can try the hack as shown in the Blackhat slides posted above.
It works by replacing an apps' core files with your own, but keeping the capability restrictions of the original app. (Use http://forum.xda-developers.com/win...p-customwpsystem-patch-xaps-wpsystem-t2975419 for example)
So just target an app with ID_CAP_OEMPUBLICDIRECTORY, deploy your custom payload and use it to copy the WhatsApp files somewhere.
Given the full FS access, is there any way to access the Whatsapp key file like on Android. That's what you would need to access the backup files instead of the unencrypted current message database, which is easily opened as SQLite database?
Hello ... I'm new here ... just wondering if there is any answer to this question ... I know it's not a recent discussion, but I really need some help from you guys. I have a wp where whatsapp is installed, but it's asking for verification and I dont have no more the sim card related to that account ... I saw chats, but then I made a huge mistake (opened whatsapp while I was online) and now I cannot access to those anymore ... I have messages.db but I'm unable to retrieve the key to decrypt that ... there are tons of posts about similar issue on android or IOS, but I need the same for WP ... is it something someone can drive me through? Thanks a lot in advance
If your phone has the Full-FS-Unlock enabled you can get the unencrypted databases at C:\Data\Users\DefApps\APPDATA\Local\Packages\5319275A.WhatsApp_cv1g1gvanyjgm\LocalState (or similar package name).
Or you can get unencrypted backups from C:\Data\SharedData\OEM\Public\WhatsApp
Or you can use a interop-unlocked File Manager App
jumpz said:
If your phone has the Full-FS-Unlock enabled you can get the unencrypted databases at C:\Data\Users\DefApps\APPDATA\Local\Packages\5319275A.WhatsApp_cv1g1gvanyjgm\LocalState (or similar package name).
Or you can get unencrypted backups from C:\Data\SharedData\OEM\Public\WhatsApp
Or you can use a interop-unlocked File Manager App
Click to expand...
Click to collapse
The files in C:\Data\SharedData\OEM\Public\WhatsApp seem to be encrypted as well … Or can you just not open them with a standard SQLite viewer?
weaselmc said:
The files in C:\Data\SharedData\OEM\Public\WhatsApp seem to be encrypted as well … Or can you just not open them with a standard SQLite viewer?
Click to expand...
Click to collapse
No, these files are indeed encrypted.
The winwazzapmigrator software did a good job migrating my database to a new android phone.
Tool to access file system on Windows 8.1 mobile
jumpz said:
If your phone has the Full-FS-Unlock enabled you can get the unencrypted databases at C:\Data\Users\DefApps\APPDATA\Local\Packages\5319275A.WhatsApp_cv1g1gvanyjgm\LocalState (or similar package name).
Or you can get unencrypted backups from C:\Data\SharedData\OEM\Public\WhatsApp
Or you can use a interop-unlocked File Manager App
Click to expand...
Click to collapse
Can anyone help me with a tool to access the file system where app files are stored on a windows 8.1 mobile?
me too
PritiM said:
Can anyone help me with a tool to access the file system where app files are stored on a windows 8.1 mobile?
Click to expand...
Click to collapse
I do have the same request...
Hi there,
I have found very good guides on how to decrypt crypt8 files.
However, is there any way to decrypt crypt8 files without the key?
Could this AES key be of any use? Or is that not applicable to crypt8?
8D4B155CC9FF81E5CBF6FA7819366A3EC621A656416CD793
This seems to be a general available key, that might be able to be used to decrypt. However I don't know how to go from this key to a .key file.
Is there any way to obtain that key even after WhatsApp was reinstalled?
Many thanks
Hello everyone,
It's been like 10 years I didn't post anything on a help forum... Well, looks like this is the day I can't find the answer somewhere on the internet.
Some month ago (nov 2015) I tried to encrypt my Samsung S4 mini gt-i9195 while running CyanogenMod 13. Well, encryption fails on CM13 looks like this is a known fact but I didn't know at the time...
All I neede on that phone and which was not backed up since aug 2015 was the sms database. I don't really remember how but I managed to retrieve the mmssms.db file on a computer (probably thanks to TWRP).
Now, here is where it gets tricky : I can't open the database... I read that the DB is an sqlite one, so I opened it with DB Browser. First on linux, which didn't work as SQLcipher is not included at first with DB Browser (the error given was "invalid file format"). The simple way was to get on the windows machine and open the file there, with DB Browser as the windows version includes SQLcipher. When the software opens the DB is asks for a password (and assumes that the page size is 1024). And no one of the passwords I use works (nor the PIN code).
This is not a password problem I'm 100% sure of it, believe me (I'm a control freak with passwords).
As far as I remember, the phone didn't ask for a password but for a pattern. I believe the file is encrypted with a pattern but how can I transform a pattern into something alphanumeric ? Or, is there anything else I can do ? All I see right now is bruteforcing the DB for days... Maybe one of you here has an other solution ?
Thanks !
Hey there guys. I am currently trying to retrieve whatsapp conversations from one of my older phones, a Huawei Ascend G510. However, the thing is that when I found the phone, Whatsapp was already asking to verify my phone number, and I don't have the old number nor the old SIM card anymore, my brother also updated whatsapp to the newest version, thinking this would somehow help, needless to say that now when I open Whatsapp it just asks to verify my number, which I don't have anymore. However I managed to find the original crypt7 files, dated all the way back to 2014, I managed to root the device in order to search for the key file, but the thing is I cannot find it anywhere.
Strangely enough, the folder data/data/com.whatsapp contains only these folders:
- app_Keys (made in 2013, but is empty);
- app_minidumps (empty);
- cache;
- code_cache;
- databases (another old folder, containing _jobqueue-WhatsAppJobManager, _jobqueue-WhatsAppJobManager-journal, axolotl.db, axolotl.db-shm, axolotl.db-wal, google_app_measurement_local.db, google_app_measurement_local.db-journal, wa.db, wa.db-shm, and wa.db-wal);
- files;
- lib;
- no-backup;
- shared_prefs.
None of them contain a key file. I read some threads here in the forums, everybody was saying that without the key file, the crypt7 backups are useless. However, I thought that I should also check it with the SQLite Editor app. And surprise. It opened the crypt7 backups. The SQLite Editor opened the conversations, the only problem being that instead of a date it's just an unintelligible timestamp. However, this lead me to believe that the key file must be in there somewhere, otherwise the SQLite Editor couldn't have opened the backups. Does anyone know how can I find it, where could it be, so I can decrypt the backups and be able to read the conversations properly, with a date and time on the messagges? Thank you.
Hi all,
My problem is the following: my phone's screen is dead, the phone has full disk encryption turned on, I know the password, I need to retrieve data on it and I have an encrypted back up.
The phone is a Samsung Galaxy S7. I cannot access files by plugging the phone into my computer as I can't unlock the phone without the help of the screen. USB debugging is not enabled.
I have a recent backup of the files made with Samsung's Smart Switch. However, all apk files as well as most files are saved as "enc." files and not readable decrypted files.
I have tried using gpg and openssl tools to decrypt those files individually with the FDE password of the phone without any success.
What are my options to A) either access my phone's content without the use of the screen B) or decrypt those encrypted backed up files I have given that I know the phone's password?
Thanks