How is the key for WhatsApp's .crypt files (message database) created? - General Questions and Answers

I know that WhatsApp encrypts the user's message backup in a file with the extension .crypt/.crypt1,2,3,4,5,6,7,8,9. This file is stored on the device along with a key file in a separate location. When the user wants to restore this backup to his new Android phone, he simply transfers the .crypt file to the new phone, installs WhatsApp, verifies his number and the backup is restored. The same is done for Google Drive backups. There are tools like whatcrypt.com that can decrypt such a backup given the key file.
But, this key has to be something that WhatsApp can be later guess using only the phone number, because this is what usually supposed to happen. (You do not transfer the key file itself to the new phone, so WhatsApp has to guess it somehow)
Does anybody know how this key is created? is it random?

Related

WM6 address book/contacts deleted (after ActiveSync?) ?

Hi all,
First of all, I've seen F*!K, undelete contacts? - xda-developers, but I'm not sure it applies completely to me, so here it goes...
Somehow, all my contacts have disappeared - except for five: two on phone (and three others on the SIM). The only event I can think of, that may have caused this, is that I tried using ActiveSync on an EEE PC with one of those efw things active (which redirects all file writes to RAM), and no Microsoft Outlook installed.
I have found logs in \Windows\ActiveSync folder on the phone, called CtrlLogX.txt, posted the last entries here http://pastebin.com/f4ba24ed6 - however, the log refers to mypc1 (my usual PC, which also does not have Outlook installed, but never seemed to cause any problems like this), which is not the EEE PC above (that EEE PC doesn't seem to be referred to anywhere in these logs).
Additionally, I've found a pim.vol file, 580 KB, in the root of the phone, which if opened in a text editor, actually STILL seems contain old contacts... The phone has not been rebooted (I think) ever since that EEE syncing event (and some weeks before that)..
The SMSes still show contacts with names, however, when I click on the contact, it tells me "Confirm: This person is not in your contact list. Do you wish to create a new contact for this person?" I of course enter NO, because I'm afraid "yes" would overwrite the pim.vol file...
Can anyone explain what has happened, and how to possibly get the contacts back? In line with that, I'd also ask:
- Where are ActiveSync logs kept on the phone (that is, is there anything else than \Windows\ActiveSync\CtrlLogX.txt)
- How are contacts stored on WM6 (is it only the pim.vol file - or is there anything else? If contacts were saved as one file per contact, and if ActiveSync deletes these files - then would it be possible to undelete the contact files [given deletion on mobile device also works by deleting entries in partition table, but not zeroing the actual memory]?)
Thanks for any responses...
[bump] any help? Still haven't rebooted the phone - perhaps there is some precautinary measure I could take before rebooting? Already backed up the pim.vol...
[bump] ok... decided to bite the bullet, and rebooted the phone - still no contacts, but the pim.vol file is still as big as before... So what should I make of this - that the pim.vol is corrupt? How could I repair it (short of copying all human-readable contents inside by hand)?
Anyone know anyone at Microsoft that could share the structure of the pim.vol file, LOL
By the way, if this is NOT the forum to ask questions like these - could someone at least suggest a forum where I could ask about my problem?
Thanks...
You can backup the pim.vol file first. And then you can download a problem called "spb Backup". You can view the pim.vol by this software.
WM6 address book/contacts deleted (after ActiveSync?) ? - corrupt pim.vol
Secguard, thanks for your response!
secguard said:
You can backup the pim.vol file first. And then you can download a problem called "spb Backup". You can view the pim.vol by this software.
Click to expand...
Click to collapse
I trieb Spb Backup briefly, but I simply cannot see how it can view the pim.vol file - it can backup personal information data which is in the pim.vol.
Well, I finally managed to solve my problem thanks to an old Sprite backup I had, which had an uncorrupt pim.vol file. Those contacts that did show up (mentioned in OP) were apparently added later - after the original corruption occured?..
Anyways, I used the PIM Backup software (which besides being freeware, also saves data in human-parsable CSV like format) to backup these "later" contacts; then I restored the old Sprite backup with an uncorrupted pim.vol file, and then I used PIM Backup again to append the "later" contacts to the uncorrupted pim.vol. Finally, used PIM Backup to backup this appended pim.vol file, and I am not worried about contacts data that much!
Well, just wanted to write a bit about what I've found out so far about similar problems - maybe help out other lost souls like mine Searching for "corrupt pim.vol" does indeed return quite a bit of hits - I should've thought about that phrase earlier
Part 1
First of all, I am not the only one who has had a problem with a corrupt pim.vol file (see also post 578 - PIM Backup; Delete Active Sync Relationship deletes my Contacts =(; ActiveSync 3.x Troubleshooting Guide - Missing Calendar, Contacts ...; contacts recovery after active sync; ActiveSync Deleted my phone contacts , when i removed the profile ...):
Question: XDA Orbit 2 - Lost Contact List. Please help - 4WinMobile.com said:
http://www.4winmobile.com/forums/phone-edition-general/16269-xda-orbit-2-lost-contact-list-please-help.html
------------------------
I did not have "clicked" an option that it synchronize the contacts because I do not have Outlook installed on my computers. I do not know what is the reason that all my contacts gone
Click to expand...
Click to collapse
NEW PIM Backup v2.8 NEW - Page 110 - xda-developers said:
http://forum.xda-developers.com/showthread.php?t=299705&page=110
------------------------
ActiveSync was delete ALL of my contacts when partnership was broken. I’ve open this “empty” pim.vol via HEX-editor and FOUND ALL deleted phone numbers…
Click to expand...
Click to collapse
Same as me - except those are most likely not leftover deleted contacts, but parts of the call log, as noted here:
All contact names are lost . . . - Motorola Q Forum | Everything Q said:
http://www.everythingq.com/forum/motorola-q/all-contact-names-are-lost-15016.html
------------------------
After doing a lot of digging aroung on Google and looking at my pim.vol file in notepad, it did appear I lost all my CONTACTS info. The names and phone numbers that were still in the file were my RECENT CALLS.
Click to expand...
Click to collapse
So, if pim.vol gets corrupted and contact data is missing, nothing can retrieve the missing data - my uncorrupted pim.vol is some 700 KB, the corrupted one is some 500 KB - as said before, those contacts that can be seen from a hex editor are most likely recent calls. In that case, it cannot be read neither by PIM Backup, nor anything else that reads pim.vol the usual way:
pocketpc developer Re: Retrieve contacts from database(EDB) API said:
http://www.eggheadcafe.com/conversation.aspx?messageid=30928125&threadid=30554221
------------------------
Pimbackup is good (great, even) if you can access your pim.vol, but I can't (via the mobile device).
Click to expand...
Click to collapse
In my case too - Pim Backup could only retrieve the same three contacts from the corrupt pim.vol as I got shown in Contacts (probably since it uses poutlook to read the contacts?) ..
The files pim.vol and cemail.vol seem to be central to contacts and sms messages:
NEW PIM Backup v2.8 NEW - Page 13 - xda-developers said:
http://forum.xda-developers.com/showthread.php?p=1204075#post1204075
------------------------
Everything is retrieved from cemail.vol and pim.vol used by tmail.exe and poutlook.exe
Click to expand...
Click to collapse
WM6 address book/contacts deleted (after ActiveSync?) ? - corrupt pim.vol
Part 2
Now, pim.vol and cemail.vol seem to be special files - not files as such, but instead databases:
Reading pim.vol / EDB-File on a PC - microsoft.public.pocketpc.developer | Google Groups said:
http://groups.google.com/group/microsoft.public.pocketpc.developer/browse_thread/thread/a1bb6e70c6c34479?fwc=1&pli=1
------------------------
pim.vol is a CEDB/EDB database. Use CeOpenDatabaseEx2 to open the database and other related functions to read record from it. Refer to http://msdn.microsoft.com/en-us/library/ms923930.aspx.
In particular, "clog.db" contains the call log history.
Click to expand...
Click to collapse
pocketpc developer Reading pim.vol / EDB-File on a PC said:
http://www.eggheadcafe.com/software/aspnet/30208939/reading-pimvol--edbfil.aspx
------------------------
I want to read the data from a pim.vol-file on a desktop-Computer. (In my case, this file is from a PDA running Windows Mobile 05) What I already know is:
- pim.vol contains all contacts, Appointments and Tasks
- the data is saved in a EDB-Database-Format
- the easiest way to read it out is through the POOM-API (on the Windows Mobile device itself)
...
Is the specification for the file-format publicly available somewhere? If so, I cold try to write my own parser for this file format. Or is there already any PC-Application that I could use to read this data?
http://www.eggheadcafe.com/conversation.aspx?messageid=30208950&threadid=30208939
------------------------
The format is not published and here you have two issues - both the .edb
file format and also the PIM data layout. You'd be better writing a simple
service provider for the device (calling POOM) which you can query from the
desktop over RAPI or sockets etc.
Click to expand...
Click to collapse
In which PIM edb database my inbox is saved said:
http://forum.soft32.com/pda/PIM-edb-database-inbox-saved-ftopict58079.html
------------------------
The volume is "pim.vol" (Actually, the volume is not pim.vol. - cemail.vol) You can use a database viewer (try one at http://www.smartphonedn.com/libraries/dbviewsp.html) or just enumerate all databases at this volume from your program to find the database you are looking for.
You need to use CEDB (not eDB) to access your email database directly. However, it is recommended to use CEMAPI and not CEDB directly. The internal format can be changed or database can be moved from release to release. So if you access the database directly your application will be broken in this case.
Click to expand...
Click to collapse
pim.vol format? - Mombu the Microsoft Forum said:
http://www.mombu.com/microsoft/pocket-pc-developer/t-pimvol-format-1531518.html
------------------------
The best way is to use POOM on the device and write your own app to interface with this data that you can use to talk over your activesync connection to a desktop component. The underlying format is EDB for the Windows Mobile 5.0 pim database, the APIs for which are documented in the WM5.0 SDK, but you'll find it much easier to use POOM to do the hard work for you.
Click to expand...
Click to collapse
How to read a pim.vol file - Stack Overflow said:
http://stackoverflow.com/questions/554578/how-to-read-a-pim-vol-file
------------------------
There is no desktop based way to read vol files.
Vol files are CE database files which can be in one of two formats (CEDB, EDB). The pim.vol file is in EDB format. There is no desktop database libraries for these formats.
You can write a Windows Mobile application to export any vol file (it's not that hard). The problems you will have is that the pim.vol database table format is different between the different versions of WM.
If you want something to be WM version agnostic, you could use the POOM API, which is the WM native API for getting access to the PIM data. It's a lot slower than the direct database access tho.
Click to expand...
Click to collapse
Corrupt pim.vol file - xda-developers said:
http://forum.xda-developers.com/showthread.php?t=298798
------------------------
What you will need to do is to downgrade back to the AKU level that you were at when you saved the pim.vol. Then copy the pim.vol back to your phone and sync with Activesync so that everything is updated...
From what we have found, pim.vol files cannot be used from other AKU roms. So, a pim.vol form 2.0 will not work with 3.3.
Click to expand...
Click to collapse
Now, from all these it really does not seem that one can read pim.vol and cemail.vol short of programming an application for a mobile device. However, for pim.vol, one must mention user Sasha and his fantastic perl script that is a binary parser for pim.vol files:
pocketpc developer Parser for pim.vol said:
http://www.eggheadcafe.com/conversation.aspx?messageid=30999264&threadid=30208939
------------------------
I found the english text and numbers are plain text in pim.vol file. As result I made a small program that parse binary data well and gives tel numbers as result (first it gives numbers from last calls list and then contact list):
Click to expand...
Click to collapse
The source is given in the post - and it even worked for me, for some corrupted entries - however, those are again, most likely call logs, and also, most of the stuff I got back was in the format:
Contacts Databasecol;12845087
so it didn't help me too much..
Also, one can use the great XdaUtils / itsutils command line utilities XDADeveloperWiki - Xda Utils, to browse the phone databases. Parts of the source mention:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdblist.cpp said:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdblist.cpp
------------------------
* on wm2005 the internal database api changed, and unfortunately the
* external database api was not changed. leading to a not working api
Click to expand...
Click to collapse
Maybe that is why, when one executes "pdblist -v", one gets cemail.vol listed - but not pim.vol!! Thus, cemail can be browsed through these tools, but not pim.vol ("pdblist -v pim.vol" for me results with "ERROR: CeUnmountDBVol(pim.vol) - The parameter is incorrect."). However, all of the SMSes from cemail.vol - in fact all data from all acccessible databases - can be dumped and they are readable too (except this dump cannot be restored) from the command line by using:
Code:
pdblist -D -r>alldb.txt
alldb.txt will be some 2MB text file, which will also contain SMS text messages.. Apparently there are plans for these command line utilities to also offer restore:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdblist.cpp said:
http://nah6.com/~itsme/cvs-xdadevtools/itsutils/src/pdblist.cpp
------------------------
// todo:
// - add itsutils interface for wm2005 edb databases
// *DONE -> PoomInterface
// - add delete record function
// - add import database from text file function
Click to expand...
Click to collapse
but who knows if that will get implemented..
Pretty much the same data given by XdaUtils (that is, cemail.vol yes, pim.vol no) can also be seen from dbviewsp (see above for link) running on the mobile phone.
It is possible to backup the pim.vol file on my phone directly - using a rename trick; but the same is not possible with cemail.vol:
Pim.vol for Contacts & Master Reset - PPCGeeks said:
http://forum.ppcgeeks.com/showthread.php?t=15671
------------------------
As far as i know you can copy the pim.vol file, but the phone will not let you paste it. I tried to do that with my cemail.vol file when I got my new phone so I could keep all my sms messages but it told me that the file is in use.
If you copied your old pim.vol file paste it in the new phone under file explorer/my device. if it wont allow you to paste it because of the old pim.vol file already in the new device, just rename the old file to pin then paste the new PIM file there and soft reset. after the soft reset you should be able to delete the pin file and you new contacts will be added
Click to expand...
Click to collapse
The page Backup & Restore your Cemail . vol easily - xda-developers shows a MortScript that should theoretically save the cemail.vol file; it seems to work for some, didn't for me. Maybe because of this:
pocketpc developer Re: Backup / Restore cemail.vol said:
http://www.eggheadcafe.com/conversation.aspx?messageid=29338960&threadid=29338958
------------------------
You shouldn't try to directly backup/restore the databases because they contain links to Oids in other tables. Since Oids are assigned by the database engine and not persisted in a backup they will be invalid when you restore. You'd be better to use CEMAPI enumerate the accounts, folders and messages and persist in some format of your own choice, then use CEMAPI to write them back again. This would also allow you backup/restore across different OS versions.
Click to expand...
Click to collapse
Well, that should be it - hope this helps someone..
Cheers !

[Q] Looking for an app that automaticaly backups Callendar data

I will have Galaxy S4 (i9500) shortly (currently have sgs+) and I'm looking for an application that will allow me to backup the local callendar data that are written localy in the phone (not on google account) to my dropbox folder.
All I need, is an application that will either automaticaly (ideally) detect I made some changes in the local callendar (like add event, delete event etc) and it will automaticaly make a backup of the callendar and copy(or overwrite if there was already a file there with backup) it to a local destination path that I will define, or will do a periodic backups in the intervals that I will define (like say every 7 days).
So once that happens (copy the backup file to a path), dropbox app will detect the change in the local structure of it's folders, and will upload the changed file to the dropbox cloud.
All in all, that will help me prevent some tragedy, in case my phone will go bust suddenly without any notice and my local data will get lost (in consequence all my hundreds, and hundreds of events written inside the local callendar).
Anybody know of an application like that?
lukair1983 said:
I will have Galaxy S4 (i9500) shortly (currently have sgs+) and I'm looking for an application that will allow me to backup the local callendar data that are written localy in the phone (not on google account) to my dropbox folder.
All I need, is an application that will either automaticaly (ideally) detect I made some changes in the local callendar (like add event, delete event etc) and it will automaticaly make a backup of the callendar and copy(or overwrite if there was already a file there with backup) it to a local destination path that I will define, or will do a periodic backups in the intervals that I will define (like say every 7 days).
So once that happens (copy the backup file to a path), dropbox app will detect the change in the local structure of it's folders, and will upload the changed file to the dropbox cloud.
All in all, that will help me prevent some tragedy, in case my phone will go bust suddenly without any notice and my local data will get lost (in consequence all my hundreds, and hundreds of events written inside the local callendar).
Anybody know of an application like that?
Click to expand...
Click to collapse
For that, i use Super Backup (https://play.google.com/store/apps/details?id=com.idea.backup.smscontacts&hl=fr).
It does the job :good:
You're very close to my parameters, but still it's off by 2 factors.
1. Although it has scheduled backups, it can be only set for contacts, sms and call logs. No callendar backup option for scheduling.
2. Although it allows to specify the backup path (very good), It changes the filename, so I cannot pick one and the same file to be overwritten over and over again.
But you're very close, I appriciate the try.
To sum up my requirement with one last note, I want the backups to be happening without any action on my part, I want it to be done completely automaticaly, either by a schedule or by detection of callendar change that will trigger the backup (like for example dropbox application).
lukair1983 said:
You're very close to my parameters, but still it's off by 2 factors.
1. Although it has scheduled backups, it can be only set for contacts, sms and call logs. No callendar backup option for scheduling.
2. Although it allows to specify the backup path (very good), It changes the filename, so I cannot pick one and the same file to be overwritten over and over again.
But you're very close, I appriciate the try.
To sum up my requirement with one last note, I want the backups to be happening without any action on my part, I want it to be done completely automaticaly, either by a schedule or by detection of callendar change that will trigger the backup (like for example dropbox application).
Click to expand...
Click to collapse
Humm...This one can do the job too... https://play.google.com/store/apps/details?id=com.promwad.backup&hl=fr ...but i dont see any schedule...
tolimad said:
Humm...This one can do the job too... https://play.google.com/store/apps/details?id=com.promwad.backup&hl=fr ...but i dont see any schedule...
Click to expand...
Click to collapse
It doesn't.
I found another app "my backup", which is the closest one to my needs. It has scheduled backups, and it does allow me to select only callendar. The only thing missing is that it adds automaticaly the date at the end of the backup file.
In the end I found an application fitting my bill close enough. It's called My Backup, it makes backups of many things, but I cen specificaly sellect callendar only. It allows me to select the backups path, and although it does add the date to the end of the file of backup, it allows me to set how many of those backup files will be there in the destination path. So if I choose 1, it will be making backups over and over again, with new filenames, but it will always just leave the most recent one, and the rest will be deleted automaticaly, which is also a good solution on it's own, combining it with dropbox.
The only problem they have with application which they told me are planning to change, is that the restoration of the callendars can happen on either local or online callendar, and it's not determined by the user, but it happens by chance (very strange if you ask me). Second is that they backup all events local as well as online, while I would preffer only local to be backup'd, since online ones are being stored on google servers anyway.
But, all in all the application fits the bill, and when they include those 2 fix for the above issues it will fit perfectly. Thanks to all people who tried to help.
Topic can be closed.

Restore whatsapp database from different number

Hello everyone,
So i managed to pull my old numbers database from google drive and now i would like to restore it on a new number.
Is there any possibility? I tried to simply insert the database and media in the whatsapp file and run the application but upon clicking to restore i get an error at 100%.
I suppose the database has my old number locked and therefore whatsapp wont restore the file as it normally.
Can I edit the database maybe? Change my number in there!!!
thx

recover sms ... AND restore to phone again?

the whole day i am trying to recover my - by accident - deleted sms messages, with all programs i could find,
mobisaver, minitool, wondershare, coolmuster, ifonelab, dr.fone, fonepaw...
and wth the last 5 programs look the same, there seems to only be one giant company, that puts out every android recovery soft out there.
now, actually the recovery itself was successful, i got various html files, but sorted and shown in different manner.
it would take me ages to sort this by hand into one compatible backup & restore .xml file to restore the messages.
the only program of the above that saves .csv is fonepaw, but it completly messes up the dates.
so is there ANY software/apk which can recover the deleted sms AND restore them again into the android message up, without fcking everything up?
btw im am using an A3 2015 Duos A300F with rooted stock rom on android 4.4.4.
thanks!
No because Android uses dB files. Not xmls and that file can only be written to by a system app or with root. Otherwise it's doa.
Also all the so called data recovery apps are bs. They can't do anything.
like i said, the programs did recover the deleted messages, but they only save them in a convoluted html file to read in the browser.
wouldnt be a problem to sort it directly as a xml, so eg sms backup and restore could read it, but since every software is the same and only chooses to save in this ****ty html, its not an option..
fonepaw did as the only one save in csv form, but got the dates all wrong (despite they were right in the also saved html).
currently im editing by hand the least convoluted html that was saved by easus mobisaver for each sms thread seperatly to a simply csv format, so i can restore it with veryandroid back to the phone. (the only software i found, that uses a simple csv to backup & restore the sms)

Whatsapp: local backup is found, but it can't read messages.

Hello,
I am having a strange issue with Whatsapp backups. I did backup, but after restore from either google or local backup, it says that it simply can't restore messages.
In both cases, it's getting found. To force it to restore from local backups, I removed google account from google drive.
I had saved something like 7 local backups a month ago and 7, which was made about a few days ago.
I had 2 numbers, but all backups where made with one number. If I change number to the old one, it's not finding local backups at all.
Sounds like I was not lucky with some Whatsapp version, since all 14 local backups didn't work, which made either corrupted backups or backups with some faulty coding, encryption key or something.
I wonder, if someone had this issue.
I did manage to restore half a year old messages, luckly, I had it saved with different google account. So, some whatsapp version did make a correct backup.
Please help, I don't really want to loose my messages.
Here is offers solution to find key file and decrypt using phython, but it looks more complicated than rooting.
If I root, some sites are saying that the key encryption file can be found in /data/data/com.whatsapp/files/key.
But I wonder, if I root, will I loose that key file at all? Should it be rooted already or it can be rooted after I have the issue?
Thank you.
PS. I wish if whatsapp would allow me to choose not to encrypt it and let me manage my security myself at my own risk, instead of getting stuck like this. Lets say, saving it in txt file and I would just put in into archave with password, like with RAR.
Rooting Android doesn't delete any existing files.
Thank you for something, at least...
have you found a solution?
I have the same problem.

Categories

Resources