During an ivenstigation of Whatsapp messages on a Blackberry, we found a “Messagesstore.db present on a MicroSD card.
The MessageStore.db was present in the folder .databasesWhatsApp and is a SQlite database.
After reading the database into a Sqlite browser, one can navigate to “Browse data” to the table “messages”
Next to the text in the column “Data”, there is a column “Timestamp”.
The dates and times in this column are in Unix: Millisecond value
| Data | Timestamp |
Some example text messagetext  |
1302442261665 |
The dates and times can be converted using the program DCode:
Converting hundreds or thousands of date and timestamps is not a practical thing to do. it is possible to export the columns from the Sqlite database to an Excelsheet.
Here you can use the formula:
=(CEL/86400000) + 25569 (CEL stands for the Cel where the timestamp is noted. For example L2 (Column L, row 2)
The cel must be formatted as “Date”
Examnple:
| Cel | Here we will note the whatsapp “Timestamp” column |
| 86400000 | 86400000 milliseconden = 24 hour |
| 25569 | the difference between Excetime 0 and unixtime 0 (01-01-1901 versus 01-01-1970) |