IPED
IPED copied to clipboard
Decrypt Whatsapp desktop client db files
Whatsapp Desktop Client on Windows saves the conversation databases locally in the folder below, mainly message.db.
C:\Users{user}\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState
I took a look at the database and it is an encrypted sqlite database. It seems to me to be a different encryption than that used in the mobile version. Looking at the application folder, I found the dll e_sqlite3.dll (Dot net probably). This appears to be a custom version of encrypted sqlite3.
https://learn.microsoft.com/pt-br/dotnet/standard/data/sqlite/encryption?tabs=net-cli
https://learn.microsoft.com/pt-br/dotnet/standard/data/sqlite/custom-versions?tabs=net-cli
https://www.bricelam.net/2023/11/10/more-sqlite-encryption.html
https://utelle.github.io/SQLite3MultipleCiphers/docs/ciphers/cipher_legacy_mode/