Professional Documents
Culture Documents
!README
!README
1
- WhatsApp Backup Messages Extractor for Android and iPhone
Released on May 7th, 2012
(C)opyright 2012 Fabio Sangiacomo <fabio.sangiacomo@digital-forensics.it>
(C)opyright 2012 Martina Weidner <martina.weidner@freenet.ch>
Released under MIT licence
Tested with Whatsapp (Android) 2.7.5613
Tested with Whatsapp (iPhone) 2.5.1
Last Update on May 10th, 2012 (v2.1-bugsfixed-2)
-----------------------HOW TO USE:
(see also the thread at xda-dev: http://forum.xda-developers.com/showthread.php?
p=24603294 )
1. You need to copy the whatsapp database.
On Android, either get this file:
/sdcard/WhatsApp/Databases/msgstore.db.crypt
(crypted database on SD card, can be created by starting backup from whatsapp ad
vanced settings: settings - more - Backup Chats)
or these files:
/data/data/com.whatsapp/databases/msgstore.db and wa.db
(for this you need root access. detailed instructions in the bottom of this file
. the advantage is that the corresponding contact names of phone numbers will be
displayed.)
On IPhone, get this file:
net.whatsapp.WhatsApp/Documents/ChatStorage.sqlite
(You can use an Iphone Backup Tool to get the file, e.g. I-Twin or Iphone Backup
Extractor. Make sure to create an unencrypted backup with Itunes, as these tool
s can't handle encrypted backups. Another possibility are forensic tools like UF
ED Physical Analyzer.)
2. Extract this archive (Whatsapp_Xtract....zip) to a certain folder on your com
puter, e.g. C:\WhatsApp.
3. Copy the database(s) to e.g. C:\WhatsApp (on Android, you simply copy the who
le folder WhatsApp on SD card to your computer e.g. to C:\WhatsApp and then copy
the database file from C:\WhatsApp\Databases to C:\WhatsApp)
4. You need Python and (for Android msgstore.db.crypt decryption) the PyCrypto l
ibrary
The easiest way is to install ActivePython (on Windows choose 32bit version even
if you have 64bit windows):
http://www.activestate.com/activepython/downloads
and then run install pyCrypto.bat (contained in this archive)
5. Now run whatsapp_xtract_android.bat or whatsapp_xtract_android_crypted.bat or
whatsapp_xtract_iphone.bat
.db" that you will find inside the Titanium Backup archive "com.whatsapp-[Date][some digits].tar.gz" to the certain folder.
- or using some app like AirDroid or Webkey to access files over wifi using the
PC webbrowser