blackberry-whatsapp600During an ivenstigation of Whatsapp messages on a Blackberry, we found a “Messagesstore.db present on a MicroSD card.

The MessageStore.db was present in the folder .databasesWhatsApp and is a SQlite database.
After reading the database into a Sqlite browser, one can navigate to “Browse data” to the table “messages”


Next to the text in the column “Data”, there is a column “Timestamp”.
The dates and times in this column are in Unix: Millisecond value

Data Timestamp
Some example text messagetext :) 1302442261665

The dates and times can be converted using the program DCode:

Converting hundreds or thousands of date and timestamps is not a practical thing to do. it is possible to export the columns from the Sqlite database to an Excelsheet.
Here you can use the formula:
=(CEL/86400000) + 25569 (CEL stands for the Cel where the timestamp is noted. For example L2 (Column L, row 2)
The cel must be formatted as “Date”


Cel Here we will note the whatsapp “Timestamp” column
86400000 86400000 milliseconden = 24 hour
25569 the difference between Excetime 0 and unixtime 0 (01-01-1901 versus 01-01-1970)