[General Topics] lightbrigade:
Recovering WhatsApp messages from Android phone without root

I did this on 19-20 November 2021

My phone is a stock Huawei P20 Pro CLT-L09 up to date with all Android/EMUI/app updates, connected to Windows 10 PC by USB.

This worked and I have good verifiable and complete data even though I am opted in to the multi-device beta, with the caveat that most viewing tools are not (yet) updated to understand the new database structure that it uses.

If you already have a crypt14 encrypted WhatsApp message database, this will recover the keyfile to allow decryption too - key from phone tested against my crypt14 database I downloaded from the Google Drive backup.

I used this method rather than exporting chats due to the 10,000/40,000 message limits on chat exports with/without media. Also that I didn't really want to export each chat individually.

Tools used on Windows 10:

GitHub - p4r4d0x86/WhatsApp-Key-DB-Extractor: Allows WhatsApp users to extract their cipher key and databases on non-rooted Android devices.

Allows WhatsApp users to extract their cipher key and databases on non-rooted Android devices. - p4r4d0x86/WhatsApp-Key-DB-Extractor

github.com

Get the Google USB Driver | Android Studio | Android Developers

The Google USB Driver is required to perform adb debugging on Windows with Google devices.

developer.android.com

https://aapks.com/apk/whatsapp/version/7518022/ if this link dies, you need an APK of WhatsApp of an old enough version. This is v2.11.431 and worked for me.

https://github.com/B16f00t/whapa/ (I actually put this in a Linux VM, with an additional sudo apt install python3-tk required to get that running)

The WhaGoDri tab in Whapa works brilliantly for recovering a Google Drive backup of your database (if you use 2FA, set an app-specific password for this tool) - as of October 2021, this now downloads a msgstore.db.crypt14 encrypted format. All the media associated with it is still unencrypted and downloads just fine. Personally I ran this first to have a clean data set to work from, and it's by far the easiest way to get the media. If you don't do this, then copy the media off the phone manually.

Starting out:

I would suggest opting out of the WhatsApp multi-device beta if you're currently in. I didn't - but if you do, then your final output should be better supported by existing tools for reading WhatsApp chats such as https://andreas-mausch.de/whatsapp-viewer/.

I backed everything up to Google Drive manually and downloaded all files from that backup with Whapa. After that you will need to set WhatsApp on the phone to "Never" back up to Google Drive and press backup again to create the local backups needed - otherwise the tools will fail.

Put your phone into developer mode, enable Android debugging over USB, personally I set it to permit during charging too so if it's connected, it's debugging. Fewer points of failure. Install the Windows Android drivers.

Unzip the WhatsApp Key DB Extractor into a folder (I created one on the desktop)

Add the old version of WhatsApp to the tmp folder and call it LegacyWhatsApp.apk

Now I needed to EDIT the WhatsAppKeyDBExtract.ps1 script (I used this rather than the batch script, if you want to use the bat file you're on your own!)

Following line 91 (should be after "Install complete" of LegacyWhatsApp.apk and before "If ($sdkver -ge 23)") I added the following line:

Read-Host 'Please open WhatsApp now'

As to why I added this point to pause in the program - it seemed to work better than not opening WhatsApp - it allows Android to set permissions for the old app to work better in the next steps.

Now you're ready to start!

Right-click the WhatsAppKeyDBExtract.ps1 script and select Run.

It will unload and save out your newest version of WhatsApp, and load in the legacy version. Once you are prompted to open WhatsApp from the line we added above, open the newly-installed old version and allow it all permissions requested. Don't worry that it then crashes out.

Then press Enter in the Powershell window and let it complete.

Note this may all take quite a lot of time - my crypt14 database from Google Drive was about 250MB, the unencrypted database upwards of 500MB, and the transfer time was probably about 5 minutes. So don't worry if it doesn't look like it is doing a lot!

At this point you are done! Check the findings: in the extracted folder, you should have the three critical files

1. msgstore.db which is your unencrypted message database (if you want to sanity check this, use a tool like DB Broswer (SQLite) or just a text editor and look for readable text to show it is not encrypted)

2. wa.db which is needed to assign contact names to the messages

3. whatsapp.cryptkey - this last one will let you decrypt the crypt14 file we saved from Google Drive earlier using Whapa. This is usually the hard one to get without rooting the phone!

If the process goes wrong at any point you might have the phone in a weird state. Personally I found uninstalling the old version of WhatsApp (ensuring that the checkbox was set to KEEP the data on the phone), reinstalling the newest version from the Google Play Store, opening that and letting it reload the WhatsApp chat backup from the phone was sufficient to get me ready to start again with no data loss.

As I mentioned at the start. Current tools (WhatsApp Viewer and Whapa) don't cope with the changed database structure that the multi-device beta uses in the same files. It doesn't look too complex to work out which old fields correspond to new ones to modify the readers, but that is an exercise for another day...

Things that DIDN'T work:

https://github.com/EliteAndroidApps/WhatsApp-Key-DB-Extractor - too old and the java code throws an error on the version on Android, ultimately failing to recover anything useful

https://github.com/SimonGhoul/Manual-WhatsApp-Key-DB-Extractor - not that it doesn't work per se, just the more automated version above has fewer steps for a novice user to screw up with!

https://www.imyfone.com/transfer-backup-restore-whatsapp/ - failed to decrypt the Google Drive recovered version (and I wasn't wild about giving my Google account creds to a random Chinese company either), also failed on some sort of timeout when recovering data through USB.

KingoRoot (both PC-based or APK directly) - doesn't support a P20 Pro CLT-L09 on latest version of Android, so no root for me that way

TWRP rooting - this will wipe the phone entirely and I was not convinced I'd get my data back from Google Drive! So I didn't try this

https://mobiletrans.wondershare.com/ - actually, technically speaking this works perfectly (as long as you follow the instructions *exactly* and are very patient). But I didn't like the proprietary interface and clunky chat export mechanism, nor the having-to-pay-for-it part :)

Things I haven't tried:

Importing anything to iOS. I'm making a clean start on my new phone!

Questions / comments / support:

Honestly I just documented this as it worked for me on this date with the current versions of stuff, I couldn't find any other instructions that worked without modification. I don't hack around with WhatsApp and phones for fun or for a living, I just wanted a readable backup to go back to as I'm switching to iOS. So... I probably won't check this again, but I hope it helps provide a data point and links/instructions for something that works.