Allthoug Whatsapp was no longer installed on the device, we did ind a SQlite database containing traces of the use of Whatsapp.
We found the database at:
We also found some files that seem to have been sent as attachment to a Whatsapp message. They seemed to be thumbnails of regular pictues.
The stee different Chatstorage databases contained incoming and outgoing Whatsapp messages. Using a Sqlitebrowser, we could see the data inside the databases.
After loading the database into the software, one can go to the tab: “browse data” and then to the table: “ZWAMESSAGE”.
Next to the column Ztext, there is a column ZMESSAGEDATE. The date and time in this column is noted in “Mac: Absolute time”.
|ZMESSAGEDATE||Converted date and time||ZTEXT||ZTOJID|
|317080738||18-01-11 9:58 PM||Some example text email@example.com|
Using DCOde, one can convert the ZMESSAGEDATE data and timestamps:
Converting hundreds or even thousands of dates and times is not an option, so it is possible to export the found data from the Sqlite browser to an Excel-sheet.
From there you can convert the dates and times using the formula:
=(CEL+3187468800)/86400 where CEL means the Cel that needs to be converterd. For example, L2 (Comumn L, row 2)
The cell must be formatted as “date”.
|Cel||The value from the whatsapp ZMESSAGEDATE column.|
|3187468800||Value used to decode the data properly (Excel starts “counting” from 01-01-1901 while Mac time starts at 01-01-2001.)|
|86400||86400 = 24 hour in seconds|
Whatsapp still installed on an iPhone
On another iPhone, where we found Whatsap normally installed. the Chatstorage database was found on an other location.
The sqlite databases where found at:
In the ChatStorage.copy.sqlite we found some messages we did not find in the regular ChatStorage.sqlite database.