WhatsApp Index Forensics

I have the pretty cliche story of a dysfunctional household that at some point required me to extract the deleted messages off my dad's phone for family court. Circumstances sucked, but the project got me really into ethical hacking! So net positive. I built a Python workflow to extract WhatsApp data from an encrypted iPhone backup. I wrote a bunch of scripts that put together capture, mapped backup files to their original locations, extracted the databases, and put their historical search-index entries back in proper order. I used existing libraries for the iPhone backup protocol and decryption, then built the selection and analysis logic around those libraries. There were a lot of obstacles here.

One was building a filtered receiver that kept all the WhatsApp database files and backup metadata while discarding all the 26GB of unrelated payloads that come up with backing up an iPhone's files. Backing up the iPhone introduced a whole different layer of complexity. Its file payloads used hashed identifiers, so finding a database meant reading the manifest that connected those identifiers to application domains and paths. I wrote an extraction process that used the existing local-backup password to unlock the relevant files, produced separate working copies and recorded all the hashes to check that the originals hadn't changed. A capture retained 39 database files.

My initial database queries did not recover the missing conversation, which drove me to look into how the application represented the same info elsewhere. And a useful finding came from its search index. I wrote a parser for SQLite FTS4 segments, decoding compressed terms and the document lists that linked them to indexed records. I kept historical segments separate so different versions would not be slightly combined, and also checked how the index encoded conversation identifiers against surviving records. That mapping matched all 2,650 eligible records. This identified 473 historical search entries associated with the cleared conversation that were absent from the current search records. Some had useful words while others contained attachment markers.

The original sentences couldn't be retrieved as ordinary message rows. In this index the original word order, repeated words, punctuation and exact timestamps were unavailable. I produced possible reconstructions of 40 text entries, and from those got all the evidence we needed!

This brought about my interest in ethical hacking. I turned the reusable parts of this work into an open-source toolkit. It has backup extraction, database inspection, historical index analysis and reports of retained terms. To make this even better I've also recently added a separate searchable analysis index, because re-indexing makes the extracted terms easier to look into while also not overestimating the confidence in them being in the correct order.

Honestly my main takeaway from this project is that A) nothing you do on your devices is truly private and B) breaking into things for the greater good is a very good use of skills and time.