IPED icon indicating copy to clipboard operation
IPED copied to clipboard

Decrypt Whatsapp desktop client db files

Open gfd2020 opened this issue 1 year ago • 3 comments

Whatsapp Desktop Client on Windows saves the conversation databases locally in the folder below, mainly message.db.

C:\Users{user}\AppData\Local\Packages\5319275A.WhatsAppDesktop_cv1g1gvanyjgm\LocalState

I took a look at the database and it is an encrypted sqlite database. It seems to me to be a different encryption than that used in the mobile version. Looking at the application folder, I found the dll e_sqlite3.dll (Dot net probably). This appears to be a custom version of encrypted sqlite3.

https://learn.microsoft.com/pt-br/dotnet/standard/data/sqlite/encryption?tabs=net-cli

https://learn.microsoft.com/pt-br/dotnet/standard/data/sqlite/custom-versions?tabs=net-cli

https://www.bricelam.net/2023/11/10/more-sqlite-encryption.html

https://utelle.github.io/SQLite3MultipleCiphers/docs/ciphers/cipher_legacy_mode/

gfd2020 avatar Jun 25 '24 19:06 gfd2020