Once you’re able to create a dump of the internal memory of an Android-phone, it is possible to get crypted whatsapp-databases from t his dump if you cannot find them in the filesystem anymore.
Whatsapp-databases can disappear during the re-installation of a phone or deletion of the program.
We found a header and footer that can be used to subtract msgstorde.db.crypt files from Android devices:
Header:               x49EF23AEFF
Footer:                x2426708BF3Using these header and footer we can recover possible whatsapp databases. Because of the use of the program Whatsapp Xtract to extract data from the found files, we have to rename the carved files to msgstore.db.crypt. This because Whatsapp Xtract expects this filename. Other filenames result in errors.
If the crypted Whatsapp database was good, Whatsapp Xtract will create an HTML page, containing the whatsapp messages.If the database was corrupt, you will get an error:


Be aware; you can still get a msgstore.plain.db after you tried to decrypt the database.
Allthough a corrupted msgstore cannot be opened by a Sqlite viewer, it can be opened in Notepad, Notepadd++ or another text viewer.
Sometimes you can still find some relevant information in the decrypted parts.