Get all messages from Whatsapp Get all messages from Whatsapp android android

Get all messages from Whatsapp


Whatsapp store all messages in an encrypted database (pyCrypt) which is very easy to decipher using Python.

You can fetch this database easily on Android, iPhone, Blackberry and dump it into html file. Here are complete instructions: Read, Extract WhatsApp Messages backup on Android, iPhone, Blackberry

Disclaimer: I researched and wrote this extensive guide.


Working Android Code: (No root required)

Once you have access to the dbcrypt5 file , here is the android code to decrypt it:

private byte[] key = { (byte) 141, 75, 21, 92, (byte) 201, (byte) 255,        (byte) 129, (byte) 229, (byte) 203, (byte) 246, (byte) 250, 120,        25, 54, 106, 62, (byte) 198, 33, (byte) 166, 86, 65, 108,        (byte) 215, (byte) 147 };private final byte[] iv = { 0x1E, 0x39, (byte) 0xF3, 0x69, (byte) 0xE9, 0xD,        (byte) 0xB3, 0x3A, (byte) 0xA7, 0x3B, 0x44, 0x2B, (byte) 0xBB,        (byte) 0xB6, (byte) 0xB0, (byte) 0xB9 };   long start = System.currentTimeMillis();    // create paths    backupPath = Environment.getExternalStorageDirectory()            .getAbsolutePath() + "/WhatsApp/Databases/msgstore.db.crypt5";    outputPath = Environment.getExternalStorageDirectory()            .getAbsolutePath() + "/WhatsApp/Databases/msgstore.db.decrypt";    File backup = new File(backupPath);    // check if file exists / is accessible    if (!backup.isFile()) {        Log.e(TAG, "Backup file not found! Path: " + backupPath);        return;    }    // acquire account name    AccountManager manager = AccountManager.get(this);    Account[] accounts = manager.getAccountsByType("com.google");    if (accounts.length == 0) {        Log.e(TAG, "Unable to fetch account!");        return;    }    String account = accounts[0].name;    try {        // calculate md5 hash over account name        MessageDigest message = MessageDigest.getInstance("MD5");        message.update(account.getBytes());        byte[] md5 = message.digest();        // generate key for decryption        for (int i = 0; i < 24; i++)            key[i] ^= md5[i & 0xF];        // read encrypted byte stream        byte[] data = new byte[(int) backup.length()];        DataInputStream reader = new DataInputStream(new FileInputStream(                backup));        reader.readFully(data);        reader.close();        // create output writer        File output = new File(outputPath);        DataOutputStream writer = new DataOutputStream(                new FileOutputStream(output));        // decrypt file        Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");        SecretKeySpec secret = new SecretKeySpec(key, "AES");        IvParameterSpec vector = new IvParameterSpec(iv);        cipher.init(Cipher.DECRYPT_MODE, secret, vector);        writer.write(cipher.update(data));        writer.write(cipher.doFinal());        writer.close();    } catch (NoSuchAlgorithmException e) {        Log.e(TAG, "Could not acquire hash algorithm!", e);        return;    } catch (IOException e) {        Log.e(TAG, "Error accessing file!", e);        return;    } catch (Exception e) {        Log.e(TAG, "Something went wrong during the encryption!", e);        return;    }    long end = System.currentTimeMillis();    Log.i(TAG, "Success! It took " + (end - start) + "ms");


Edit

As WhatsApp put some effort into improving their encryption system, getting the data is not that easy anymore. With newer versions of WhatsApp it is no longer possible to use adb backup. Apps can deny backups and the WhatsApp client does that. If you happen to have a rooted phone, you can use a root shell to get the unencrypted database file.

If you do not have root, you can still decrypt the data if you have an old WhatsApp APK. Find a version that still allows backups. Then you can make a backup of the app's data folder, which will contain an encryption key named, well, key.

Now you'll need the encrypted database. Use a file explorer of your choice or, if you like the command line more, use adb:

adb pull /sdcard/WhatsApp/Databases/msgstore.db.crypt12

Using the two files, you could now use https://gitlab.com/digitalinternals/whatsapp-crypt12 to get the plain text database. It is no longer possible to use Linux board tools like openssl because WhatsApp seems to use a modified version of the Spongy Castle API for cryptography that openssl does not understand.

Original Answer (only for the old crypt7)

As whatsapp is now using the crypt7 format, it is not that easy to get and decrypt the database anymore. There is a working approach using ADB and USB debugging.

You can either get the encryption keys via ADB and decrypt the message database stored on /sdcard, or you just get the plain version of the database via ADB backup, what seems to be the easier option.

To get the database, do the following:

Connect your Android phone to your computer. Now run

adb backup -f whatsapp_backup.ab -noapk com.whatsapp

to backup all files WhatsApp has created in its private folder.
You will get a zlib compressed file using tar format with some ADB headers. We need to get rid of those headers first as they confuse the decompression command:

dd if=whatsapp_backup.ab ibs=1 skip=24 of=whatsapp_backup.ab.nohdr

The file can now be decompressed:

cat whatsapp_backup.ab.nohdr | python -c "import zlib,sys;sys.stdout.write(zlib.decompress(sys.stdin.read()))" 1> whatsapp_backup.tar

This command runs Python and decompresses the file using zlib to whatsapp_backup.tar
Now we can unTAR the file:

tar xf whatsapp_backup.tar

The archive is now extracted to your current working directory and you can find the databases (msgstore.db and wa.db) in apps/com.whatsapp/db/