blackberry-whatsapp600During an ivenstigation of Whatsapp messages on a Blackberry, we found a “Messagesstore.db present on a MicroSD card.

The MessageStore.db was present in the folder .databasesWhatsApp and is a SQlite database.
After reading the database into a Sqlite browser, one can navigate to “Browse data” to the table “messages”

whatsapp-blackberry


Next to the text in the column “Data”, there is a column “Timestamp”.
The dates and times in this column are in Unix: Millisecond value

Data Timestamp
Some example text messagetext :) 1302442261665

 
The dates and times can be converted using the program DCode:
whatsapp-blackberry-time-converter

Converting hundreds or thousands of date and timestamps is not a practical thing to do. it is possible to export the columns from the Sqlite database to an Excelsheet.
Here you can use the formula:
=(CEL/86400000) + 25569 (CEL stands for the Cel where the timestamp is noted. For example L2 (Column L, row 2)
The cel must be formatted as “Date”

Examnple:

Cel Here we will note the whatsapp “Timestamp” column
86400000 86400000 milliseconden = 24 hour
25569 the difference between Excetime 0 and unixtime 0 (01-01-1901 versus 01-01-1970)