search

KnugiHK / WhatsApp-Chat-Exporter

A customizable Android and iOS/iPadOS WhatsApp database parser that will give you the history of your WhatsApp conversations in HTML and JSON. Android Backup Crypt12, Crypt14, Crypt15, and new schema supported.
https://wts.knugi.dev/
MIT License
518 stars 76 forks source link

Error to export old images #89

Open roisec opened 4 months ago

roisec commented 4 months ago

Hi, I have old photos that I want to recover @KnugiHK, (I guess you may have an idea of how to recover it.) These pictures transfer to several devices so I guess causes some issues. When I used your tool, I saw the images were not available, I tried to sort by date and the pictures are not exported by your tool. Is there any option to export it from the iTunes backup/or your tool?

See the screenshot below, when I tried to share it I saw the hash of the file but without success exporting it. image

Thanks

KnugiHK commented 4 months ago

Hi. Just want to confirm if you are working to export your WhatsApp images or the images stored in iOS, i.e., images in the Photo app.

roisec commented 4 months ago

Hi, I don't configured it to save it on photo roll, so I don't think it will help :( Do you have another idea?

KnugiHK commented 4 months ago

Is your iOS backup encrypted?

roisec commented 4 months ago

No, the IOS backup is not encrypted. I have the iphone if needed.

KnugiHK commented 4 months ago

You can run the following SQL in the Manifest.db and check if each file in the backup is intect:

SELECT * FROM Files WHERE domain='AppDomainGroup-group.net.whatsapp.WhatsApp.shared'
roisec commented 4 months ago

@KnugiHK thanks for your response. I did a iOS backup with iTunes and I didn’t choose encryption enabled, but when I tried enter the iOS folder I saw hashed files. Do you mean I need to run your tool and then access to Manifest.db ?how can I get plain file of this db?

KnugiHK commented 4 months ago

In your iOS backup folder there should be a file called "Manifest.db". Open that with a SQLite browser and execute the SQL I mentioned above. Then, you will get the hash of each file. Using the hash, you can locate your files in the backup folder. You may want to first check the integrity of several randomly chosen files.

roisec commented 4 months ago

I succeeded to see all the hashes. Can I add the timestamp of the file hashes? Because I need the oldest photos? In Addition, let's assume I found my hashes folder; what can I do with them? Is there any way to view them?

KnugiHK commented 4 months ago

The files named with hash is the file you want as you mentioned it is not encrypted.

To add the timestamp of the files, you need to parse the bplist file embedded. You may refer to this commit.

roisec commented 4 months ago

Thanks a lot! now I am able to see newer picutres I want to export the oldest, I don't understand how to parse the Manifest.plist. How can I do it easily?