iphone-logoAfter extracing data from an iPhone, we searched for Whatsapp messages.
Allthoug Whatsapp was no longer installed on the device, we did ind a SQlite database containing traces of the use of Whatsapp.
We found the database at:

  • ChatStorage.copy.sqlite
  • ChatStorage.sqlite
  • ChatStorage~.sqlite

We also found some files that seem to have been sent as attachment to a Whatsapp message. They seemed to be thumbnails of regular pictues.

. whatsapp-iphone

The stee different Chatstorage databases contained incoming and outgoing Whatsapp messages. Using a Sqlitebrowser, we could see the data inside the databases.

After loading the database into the software, one can go to the tab: “browse data” and then to the table: “ZWAMESSAGE”.
whatsapp sqlite2
Next to the column Ztext, there is a column ZMESSAGEDATE. The date and time in this column is noted in “Mac: Absolute time”.

ZMESSAGEDATE Converted date and time ZTEXT ZTOJID
317080738 18-01-11 9:58 PM Some example text messagetext :) 316123456789@s.whatsap

Using DCOde, one can convert the ZMESSAGEDATE data and timestamps:

Converting hundreds or even thousands of dates and times is not an option, so it is possible to export the found data from the Sqlite browser to an Excel-sheet.
From there you can convert the dates and times using the formula:

=(CEL+3187468800)/86400 where CEL means the Cel that needs to be converterd. For example, L2 (Comumn L, row 2)
The cell must be formatted as “date”.

Cel The value from the whatsapp ZMESSAGEDATE column.
3187468800 Value used to decode the data properly  (Excel starts “counting” from  01-01-1901 while Mac time starts at 01-01-2001.)
86400 86400 = 24 hour in seconds

Whatsapp still installed on an iPhone
On another iPhone, where we found Whatsap normally installed. the Chatstorage database was found on an other location.
The sqlite databases where found at:
whatsapp sqlite4

In the ChatStorage.copy.sqlite  we found some messages we did not find in the regular ChatStorage.sqlite database.