Error to export old images

[roisec]

Hi, I have old photos that I want to recover @KnugiHK, (I guess you may have an idea of how to recover it.) These pictures transfer to several devices so I guess causes some issues. When I used your tool, I saw the images were not available, I tried to sort by date and the pictures are not exported by your tool. Is there any option to export it from the iTunes backup/or your tool?

See the screenshot below, when I tried to share it I saw the hash of the file but without success exporting it.

Thanks

[KnugiHK]

Hi. Just want to confirm if you are working to export your WhatsApp images or the images stored in iOS, i.e., images in the Photo app.

[roisec]

Hi, I don't configured it to save it on photo roll, so I don't think it will help :( Do you have another idea?

[KnugiHK]

Is your iOS backup encrypted?

[roisec]

No, the IOS backup is not encrypted. I have the iphone if needed.

[KnugiHK]

You can run the following SQL in the Manifest.db and check if each file in the backup is intect:

SELECT * FROM Files WHERE domain='AppDomainGroup-group.net.whatsapp.WhatsApp.shared'

[roisec]

@KnugiHK thanks for your response. I did a iOS backup with iTunes and I didn’t choose encryption enabled, but when I tried enter the iOS folder I saw hashed files. Do you mean I need to run your tool and then access to Manifest.db ?how can I get plain file of this db?

[KnugiHK]

In your iOS backup folder there should be a file called "Manifest.db". Open that with a SQLite browser and execute the SQL I mentioned above. Then, you will get the hash of each file. Using the hash, you can locate your files in the backup folder. You may want to first check the integrity of several randomly chosen files.

[roisec]

I succeeded to see all the hashes. Can I add the timestamp of the file hashes? Because I need the oldest photos? In Addition, let's assume I found my hashes folder; what can I do with them? Is there any way to view them?

[KnugiHK]

The files named with hash is the file you want as you mentioned it is not encrypted.

To add the timestamp of the files, you need to parse the bplist file embedded. You may refer to this commit.

[roisec]

Thanks a lot! now I am able to see newer picutres I want to export the oldest, I don't understand how to parse the Manifest.plist. How can I do it easily?

[KnugiHK]

Thanks a lot! now I am able to see newer picutres I want to export the oldest, I don't understand how to parse the Manifest.plist. How can I do it easily?

Ignore my last comment if you see that through email.

The latest version should have the timestamp written into the metadata of all WhatsApp media. You may want to take a look.