Need to decrypt whatsapp backup by trying out passwords offline - General Questions and Answers

I had to factory reset my phone but when I went to install whatsapp it asked me a password to restore my backups but for some reason I can't get it right, after a bunch of tries (and having to wait 12 hours) it told me that if I get it wrong one more time the backups will be deleted.
So I used this script https://github.com/sidharthv96/WhatsApp-GD-Extractor-Multithread to download my backup, which is now safely sitting on my PC in crypt15 format.
Now what can I do to try and get this database decrypted? I don't have the original key and my phone is not rooted, is there ANYTHING at all I could do?
The most ideal way would be a way to try all the passwords I can think of until I manage to decrypt it, if I try one more time the original backup will be deleted and I'd need to figure out how to upload it again but I don't even know if it can be done

Same here .. Have you found a way ?

MoroAT said:
Same here .. Have you found a way ?
Click to expand...
Click to collapse
Anyone found the solution?

Jackomel said:
I had to factory reset my phone but when I went to install whatsapp it asked me a password to restore my backups but for some reason I can't get it right, after a bunch of tries (and having to wait 12 hours) it told me that if I get it wrong one more time the backups will be deleted.
So I used this script https://github.com/sidharthv96/WhatsApp-GD-Extractor-Multithread to download my backup, which is now safely sitting on my PC in crypt15 format.
Now what can I do to try and get this database decrypted? I don't have the original key and my phone is not rooted, is there ANYTHING at all I could do?
The most ideal way would be a way to try all the passwords I can think of until I manage to decrypt it, if I try one more time the original backup will be deleted and I'd need to figure out how to upload it again but I don't even know if it can be done
Click to expand...
Click to collapse
same problem. anyone, please help us

Jackomel said:
I had to factory reset my phone but when I went to install whatsapp it asked me a password to restore my backups but for some reason I can't get it right, after a bunch of tries (and having to wait 12 hours) it told me that if I get it wrong one more time the backups will be deleted.
So I used this script https://github.com/sidharthv96/WhatsApp-GD-Extractor-Multithread to download my backup, which is now safely sitting on my PC in crypt15 format.
Now what can I do to try and get this database decrypted? I don't have the original key and my phone is not rooted, is there ANYTHING at all I could do?
The most ideal way would be a way to try all the passwords I can think of until I manage to decrypt it, if I try one more time the original backup will be deleted and I'd need to figure out how to upload it again but I don't even know if it can be done
Click to expand...
Click to collapse
same problem here did you get a solution

Jackomel said:
I had to factory reset my phone but when I went to install whatsapp it asked me a password to restore my backups but for some reason I can't get it right, after a bunch of tries (and having to wait 12 hours) it told me that if I get it wrong one more time the backups will be deleted.
So I used this script https://github.com/sidharthv96/WhatsApp-GD-Extractor-Multithread to download my backup, which is now safely sitting on my PC in crypt15 format.
Now what can I do to try and get this database decrypted? I don't have the original key and my phone is not rooted, is there ANYTHING at all I could do?
The most ideal way would be a way to try all the passwords I can think of until I manage to decrypt it, if I try one more time the original backup will be deleted and I'd need to figure out how to upload it again but I don't even know if it can be done
Click to expand...
Click to collapse
Greetings, similar situation, my WhatsApp, for some reason failed and asked me to restore from a backup, to which I proceeded to restore, then a message popped up indicating that something went wrong and that the restore could not be done and my WhatsApp started In zero conversations, I've run out of years of messages. Searching I found that I could uninstall and reinstall to force the restoration again, I did it, when the time comes to reactivate, I receive the SMS and the option to search for backup copies follows, I find both the local copies and the Google Drive one, I It asks for the E2E encryption key, (I know it) I put my password (not 64 digits), the process starts and at 44% it gets stuck, then it jumps again saying that the data cannot be recovered from that backup. Now I don't have much hope anymore, but if anyone knows how to get encrypted_backup.key on a non-rooted device, maybe I can use the tool: WhatsApp-Crypt14-Crypt15-Decrypter from ElDavoo to at least have my conversations decrypted on a PC for consultation. (My database is in Crypt15)
Thanks.

Jackomel said:
I had to factory reset my phone but when I went to install whatsapp it asked me a password to restore my backups but for some reason I can't get it right, after a bunch of tries (and having to wait 12 hours) it told me that if I get it wrong one more time the backups will be deleted.
So I used this script https://github.com/sidharthv96/WhatsApp-GD-Extractor-Multithread to download my backup, which is now safely sitting on my PC in crypt15 format.
Now what can I do to try and get this database decrypted? I don't have the original key and my phone is not rooted, is there ANYTHING at all I could do?
The most ideal way would be a way to try all the passwords I can think of until I manage to decrypt it, if I try one more time the original backup will be deleted and I'd need to figure out how to upload it again but I don't even know if it can be done
Click to expand...
Click to collapse
Any solution? is this effective? https://www.imyfone.com/whatsapp/decrypt-whatsapp-database-without-key/

Related

[Completed] Restore backup from TunesGo

Hi
Recently I decided that my almost rusty galaxy note 2 is running too slow and I installed cyagenomod14. I backed up all my data using Wondershare Tunesgo and installed new OS. Everything went great until i tried to restore my contacts. TunesGo asked me to pay 35$ for getting my info back! I have no memory of warnings that i can not restore data without buying full version (if it were i'd get different program, or hell even just written contacts down and put them back in manually). Tunesgo created .bak file that can be opened with no problem by 7-zip, though i can't extract anything becouse it is password protected. Is there any way i can get through it? I know this password have to be somewhere in the program, I'd guess maybe i could read it from memory after selecting bak file (it then scans and shows how many files are in backup). I don't need this program to restore my data, i just want to get to it.
I'd appreciate any guidence/tips!
Kelnozz said:
Hi
Recently I decided that my almost rusty galaxy note 2 is running too slow and I installed cyagenomod14. I backed up all my data using Wondershare Tunesgo and installed new OS. Everything went great until i tried to restore my contacts. TunesGo asked me to pay 35$ for getting my info back! I have no memory of warnings that i can not restore data without buying full version (if it were i'd get different program, or hell even just written contacts down and put them back in manually). Tunesgo created .bak file that can be opened with no problem by 7-zip, though i can't extract anything becouse it is password protected. Is there any way i can get through it? I know this password have to be somewhere in the program, I'd guess maybe i could read it from memory after selecting bak file (it then scans and shows how many files are in backup). I don't need this program to restore my data, i just want to get to it.
I'd appreciate any guidence/tips!
Click to expand...
Click to collapse
Greetings and welcome to assist. Unfortunately we can't help you with password cracking as that would be illegal. Have you checked to see if your contacts are backed up with your google account ? Whatever contacts you add to your google account are automatically restored on any device you sign into. There are also free apps like SMS backup&restore that will back up calls/sms/contacts and restore for free
Good Luck
Sawdoctor

TWRP Restore Error 255

Hi, I'm restoring from a nandroid backup but once it starts restoring data it fails with error 255. I have no 999 files, and ran the steps here: https://forum.xda-developers.com/oneplus-6/how-to/255-error-twrp-backup-restore-999-t3801632 to remove 999 folders (it didn't work but I looked in those folders and saw no 999 folders) and have NEVER used Paralell Apps.
Is the backup salvageable?
NateDev said:
Hi, I'm restoring from a nandroid backup but once it starts restoring data it fails with error 255. I have no 999 files, and ran the steps here: https://forum.xda-developers.com/oneplus-6/how-to/255-error-twrp-backup-restore-999-t3801632 to remove 999 folders (it didn't work but I looked in those folders and saw no 999 folders) and have NEVER used Paralell Apps.
Is the backup salvageable?
Click to expand...
Click to collapse
Can you still boot into your OS?
mikex8593 said:
Can you still boot into your OS?
Click to expand...
Click to collapse
No, because I was on the P beta, but wiped everything including system. I tested a restore with everything else except data and it worked, just data failes, and recovery.log says "==> extracting: //data/reserve-lib/com.oneplus.soundrecorder/ (mode 40755, directory)
tar_extract_file(): failed to extract //data/reserve-lib/com.oneplus.soundrecorder/ !!!" so I'm assuming that's the issue, but I don't think there's any way to edit nandroid backup files like a filesystem, is there?
Edit: So I made the data backup into a .tar file and I can see the offending folder, but can't delete it from within WinRar, but I can make it a folder and delete it. Once I have that, how do I make it back into a .win000 file?
NateDev said:
No, because I was on the P beta, but wiped everything including system. I tested a restore with everything else except data and it worked, just data failes, and recovery.log says "==> extracting: //data/reserve-lib/com.oneplus.soundrecorder/ (mode 40755, directory)
tar_extract_file(): failed to extract //data/reserve-lib/com.oneplus.soundrecorder/ !!!" so I'm assuming that's the issue, but I don't think there's any way to edit nandroid backup files like a filesystem, is there?
Edit: So I made the data backup into a .tar file and I can see the offending folder, but can't delete it from within WinRar, but I can make it a folder and delete it. Once I have that, how do I make it back into a .win000 file?
Click to expand...
Click to collapse
I think you may be able to just rename .tar to .win000, try it and see.
JazzieBoi said:
I think you may be able to just rename .tar to .win000, try it and see.
Click to expand...
Click to collapse
Yea I editited it saying I did that, but can't figure out how to make it back into .win000. I guess I will just transfer it onto the phone, backup that and then restore (as just transfering will probably mess something up)
i'm having hte same problem , i never used parallel apps and i'm getting the same error on a restore for no freaking reason!
I need to restore so badly, i can get into OS just fine now but i didn't backup my apps prior to doing the wipe after the backup.. any ideas please?
NateDev said:
Yea I editited it saying I did that, but can't figure out how to make it back into .win000. I guess I will just transfer it onto the phone, backup that and then restore (as just transfering will probably mess something up)
Click to expand...
Click to collapse
Did you get this working? I'm not very good with TWRP yet so I don't know all the lingo, but I too made a backup and receive the error 255 when trying to restore using TWRP. When I restored the backup and unchecked data like you mentioned, it finishes without error but get this error "Your device is corrupt. It can’t be trusted and may not work properly" when I try to boot it. Restoring the backup without the data box checked still doesn't restore everything obviously. I'd like to restore the data too. Did you get it all working to where you can restore all?
R0ttenB4ndit said:
Did you get this working? I'm not very good with TWRP yet so I don't know all the lingo, but I too made a backup and receive the error 255 when trying to restore using TWRP. When I restored the backup and unchecked data like you mentioned, it finishes without error but get this error "Your device is corrupt. It can’t be trusted and may not work properly" when I try to boot it. Restoring the backup without the data box checked still doesn't restore everything obviously. I'd like to restore the data too. Did you get it all working to where you can restore all?
Click to expand...
Click to collapse
So I edited the backup and removed the offending files and then put the file back into the backup but that didn't work because I guess it broke the signature or something but it wouldn't restore data at all once I edited it. Idk.
I just don't bother with backups anymore, too much of a hassle haha, and it makes no sense why it fails, since I have no parallel apps or anything
Thanks very much for the response and info! No backup at all? Bummer. I've tried to backup several times using twrp and keep asking around. In the root directions it's said how to backup and restore. Surely it's been done in this os since instructions are there.
The second time I tried, I was able to backup and restore all partitions "successfully" using the newest bluespark twrp version from a couple days ago... But I get this boot issue saying the device can't be trusted and doesn't boot.

Google Backup - No Backups Found (BUT THERE IS!!!)

Hi guys,
Getting really frustrated here!!
Have owned a Huawei Mate 20 for awhile now and recently wanted to do a backup & restore.
Made sure I backed up via Google Backup and verified on Google Drive.
Went to restore this morning and it says: NO BACKUPS FOUND. When I go into my Google Drive, I can literally SEE THE BACKUP THERE WITH ALL MY APPS.
Is there anyway to:
Force Google to restore this backup
Download this backup from Google Drive so it doesn't expire
Get this damn thing to work?!
Thanks guys, really appreciate it!
Try running bmgr in ADB commandline, from there you should be able to force restore Drive backups.
shampow said:
Try running bmgr in ADB commandline, from there you should be able to force restore Drive backups.
Click to expand...
Click to collapse
Thanks shampow.
Do you have any more information here? Assuming I have to use: bmgr restore TOKEN PACKAGE, but I have no idea how to do that.
Thank you.
KLoNe1 said:
Thanks shampow.
Do you have any more information here? Assuming I have to use: bmgr restore TOKEN PACKAGE, but I have no idea how to do that.
Thank you.
Click to expand...
Click to collapse
I haven't done it in a while so I don't remember exactly, basically you do:
adb shell
bmgr
After this you will get the commands list, one of them is list of the backups available, and other is restore.
Found a guide - thank you.
After a factory reset, and running the bmgr list sets command, it will only show the backup made since the factory reset.
If I check on Google Drive it has both backups:
This device:
Current backup since factory reset
Other backups:
Original backup
Once clicking on this backup it says: "This backup will expire in__ days if the device remains inactive.
Why does it think it's a different device? Could there be a problem with the software versions? Both should be Android 10.
Thanks again shampow.
Android backups always been a mess. The Drive backup I know that can't really be downloaded or extracted and is set to expire.
The only two things I can't think of right now, even if sound silly, is factoryreset and set account again and see what happens when the backup prompt comes.
Else maybe is less hassle to start all over again.
shampow said:
Android backups always been a mess. The Drive backup I know that can't really be downloaded or extracted and is set to expire.
The only two things I can't think of right now, even if sound silly, is factoryreset and set account again and see what happens when the backup prompt comes.
Else maybe is less hassle to start all over again.
Click to expand...
Click to collapse
Yes, I've tried a couple of times factory resetting in hopes it would change the outcome.
Originally the was a problem with security which lead to Google locking me. From my account for about a month - their Account Recovery procedure is a God damn joke - and ZERO staff who you can/ask, because "covid".
So I finally got my account back after thinking that was gone forever and now the backup doesn't work. So frustrating!
Now, when resetting my account security is there a chance it could have 'unlinked' my phone and that's saying it's another device?
The only other thing is the version. The backup was from Dec 19 and there looks like there was an update on the first of Jan. Could the version difference chance anything?
KLoNe1 said:
Yes, I've tried a couple of times factory resetting in hopes it would change the outcome.
Originally the was a problem with security which lead to Google locking me. From my account for about a month - their Account Recovery procedure is a God damn joke - and ZERO staff who you can/ask, because "covid".
So I finally got my account back after thinking that was gone forever and now the backup doesn't work. So frustrating!
Now, when resetting my account security is there a chance it could have 'unlinked' my phone and that's saying it's another device?
The only other thing is the version. The backup was from Dec 19 and there looks like there was an update on the first of Jan. Could the version difference chance anything?
Click to expand...
Click to collapse
Did you ever figure this out? It's happening to me now and Im panicking!!

[Help] How do I recover permanently deleted files from Android Mobile phone?

Recently, I have permanently deleted files from my Android device after factory reset and I didn't take any backup. Is there have any possibility to recover my important data without having any backup?
Try EaseUS MobiSaver app.
You can definitely check the local backup of your phone if you have take backup regularly then, you have enabled to restore data from mobile. Sometimes, files have an automatic backup on Google account. So, you can check your Google backup. In case, if you didn't get back lost after the factory reset then, you may also try the Android data recovery tool. There is no guarantee for data recovery by using any program. But if it will possible to recover files then, it will show the preview of deleted data during the free trial edition.
To be honest, the chances of it would entirely depend on how long you have performed the factory reset. If it has not been so long, then you can actually get your data back. Pick a recovery tool that supports your device, it will let you preview the data and restore them.
Sorry for the delayed reply. For the ones who have the same problem, usually it's difficult to recover them back. You can ask for help from pro shop. Pro shop like Dr.fone, EaseUS MobiSaver, Coolmuster Lab.Fone for Android, etc. I am not sure they can work well or not. Before that, you need to stop using your phone. Cause data can not be recovered if they are overwritten by new data. And do remember to take backup of your phone usually. It's easy and safe.
I'm in the same seat and I also managed to flash an original rom on a Galaxy S8 on top of that.
Tried trial versions of all the mentioned and some others but they aren't able to detect anything relevant.
At the moment I'm wondering whether to take the loss or hand it in to a professional.
Can they do anything more that the different recovery softwares can't?
(I thought my phone was synced through a cloud app but it turns out it wasn't.)
I have used an app Named "DiskDigger" it worked perfect for me for recovering Pictures.
Have NonRoot-Method and Root Methood
dashti.95 said:
I have used an app Named "DiskDigger" it worked perfect for me for recovering Pictures.
Have NonRoot-Method and Root Methood
Click to expand...
Click to collapse
how do i do it?
Sahurley78 said:
how do i do it?
Click to expand...
Click to collapse
its easy just download diskdigger on your android device and it have a button to start recovery
I just found this thread on google, I would like to know if anyone knows a way to recover a deleted application data folder inside the "Android/data" folder in the internal storage, either by adb, usb debugging or with some software since they are important data and I have not gotten any solution .
Thanks in advance.

Restoring Google Authenticator after stock to LineageOS 19.1

Hi,
I've just upgraded from latest OnePlus stock ROM of Android 11 to LineageOS 19.1. I've made backups before formatting everything, a full NANDroid with TWRP, one using the Migrate app, one with Oandbackupx of all apps. Also Google's way, but that doesn't back this app up, which seems to be quiet bad...
After trying to restore from all the mentioned sources, Google Authenticator can't seem to be restored. It always ends up empty. Is there a a specific protection for that data? I've similar issue with Dropbox as an example, it asks me to login after a restore. Whereas other apps preserved their logins...
Would be great to restore it, as I had like 30+ MFA codes added. Any suggestions?
Thank you!
There is only one way to transfer codes to another phone in the case of Google Authenticator.
Perhaps there is an analogy with the Dropbox access application. You'll have to check it out for yourself.
Hi,
Ok, thanks for the info. This is just sad to hear.
Going back to the original system with restoring the NANDroid backup go get this code might not work either?
Thank you.
I can't seem to find a solution. So I'm switching to Authy and in the same time I'll add it to KeePassXC, which can also do it... This can't happen again, I have to reset 2FA on 30+ sites
antivirtel said:
I can't seem to find a solution. So I'm switching to Authy and in the same time I'll add it to KeePassXC, which can also do it... This can't happen again, I have to reset 2FA on 30+ sites
Click to expand...
Click to collapse
whats stopping you from flashing your nandroid backup back to regain access? Isn't the whole beauty of nandroid backups the fact that they're more like system snapshots?
We currently are running into the same problem (although different phone, different situation but same effective result. We already came from a custom rom but forgot to get the transfer QRs from the Auth app.)
Okay so let me update you on my findings. If you have a back-up of Authenticators data (made before the update Google pushed out earlier this month*) you could fish out the database file (called database, without any file extention, stored in the folder database (full path to the file in a TWRP backup would be /data/data/com.google.android.apps.authenticator2/database/database)) and just read out the table accounts using any sqlite3 tool. This table has a column called secrets which contains the keys. There even is a free (linux/cygwin) set of scripts that can generate QRs for you if you do not feel like punching in the keys manually.
Theoretically placing the database file into the database folder of the app (overwriting the empty one) or using something like Titanium Backup should work too if you have not updated the app on your old device/installation yet.
*With the last update Google started encrypting the secrets before writing them to the database and nobody has been able to find the key which they used for that (yet)
screen said:
whats stopping you from flashing your nandroid backup back to regain access? Isn't the whole beauty of nandroid backups the fact that they're more like system snapshots?
Click to expand...
Click to collapse
I'm now on Android 12, and since TWRP doesn't support the new encryption, I can't just take a NANDroid backup of the current one and flash the old one in (without losing much of the current one, which I don't want). Unless there's something new around this, that won't be too much of a help.
I can think of restoring the NANDroid backup to an Android emulator, but it doesn't seem to be possible:
https://www.reddit.com/r/Android/comments/k7v4c/_/c2i5l9g
(unless it has changed in the last 11 years).
screen said:
Okay so let me update you on my findings. If you have a back-up of Authenticators data (made before the update Google pushed out earlier this month*) you could fish out the database file (called database, without any file extention, stored in the folder database (full path to the file in a TWRP backup would be /data/data/com.google.android.apps.authenticator2/database/database)) and just read out the table accounts using any sqlite3 tool. This table has a column called secrets which contains the keys. There even is a free (linux/cygwin) set of scripts that can generate QRs for you if you do not feel like punching in the keys manually.
Theoretically placing the database file into the database folder of the app (overwriting the empty one) or using something like Titanium Backup should work too if you have not updated the app on your old device/installation yet.
*With the last update Google started encrypting the secrets before writing them to the database and nobody has been able to find the key which they used for that (yet)
Click to expand...
Click to collapse
Yeah, I already checked that file, it's encrypted in there, I was using the latest versions of the apps when I made the backup, didn't think that won't be enough. The weird thing is that restoring it won't restore the data. So it must use some device related key or it just detects that it's a different device... Annoying, backing it up doesn't actually do any good...
Do you have any other idea? Thank you!
antivirtel said:
I'm now on Android 12, and since TWRP doesn't support the new encryption, I can't just take a NANDroid backup of the current one and flash the old one in (without losing much of the current one, which I don't want). Unless there's something new around this, that won't be too much of a help.
I can think of restoring the NANDroid backup to an Android emulator, but it doesn't seem to be possible:
https://www.reddit.com/r/Android/comments/k7v4c/_/c2i5l9g
(unless it has changed in the last 11 years).
Yeah, I already checked that file, it's encrypted in there, I was using the latest versions of the apps when I made the backup, didn't think that won't be enough. The weird thing is that restoring it won't restore the data. So it must use some device related key or it just detects that it's a different device... Annoying, backing it up doesn't actually do any good...
Do you have any other idea? Thank you!
Click to expand...
Click to collapse
Well, if Authenticator doesn't pick up on databases from other installations that would sugest that Authenticator has a way to link a database to an Authenticator installation. Meaning, the only way you could possibly have a chance to retrieve the data is to restore your nandroid backup (and use the Authenticator in there to make your transfer QR codes), count your losses as far as your current installation goes and reinstall a 12 rom from scratch. (Or find a way to get the key used to encrypt the secrets, if you have the key you just decrypt them and punch them in manually (or use the earlier scripts for QR code gen))
screen said:
Well, if Authenticator doesn't pick up on databases from other installations that would sugest that Authenticator has a way to link a database to an Authenticator installation. Meaning, the only way you could possibly have a chance to retrieve the data is to restore your nandroid backup (and use the Authenticator in there to make your transfer QR codes), count your losses as far as your current installation goes and reinstall a 12 rom from scratch. (Or find a way to get the key used to encrypt the secrets, if you have the key you just decrypt them and punch them in manually (or use the earlier scripts for QR code gen))
Click to expand...
Click to collapse
It's sad that nobody seems to have the keys to decrypt the secrets.
Wish I had a nandroid backup or just an earlier backup of the app's data before they started to encrypt their db.
I'm losing many accounts here.
shokolatha said:
It's sad that nobody seems to have the keys to decrypt the secrets.
Wish I had a nandroid backup or just an earlier backup of the app's data before they started to encrypt their db.
I'm losing many accounts here.
Click to expand...
Click to collapse
To prevent exactly this from happening (again) I've switched to Authy like @antivirtel suggested earlier. Authy saves your secrets to your authy-account, and a big plus they actually have a desktop program too so I don't have to use my phone per se (I often just leave it home not needing my phone _untill_ I need 2FA somewhere lol). I'm sorry for your losses but at least take this as a learning oppertunity and switch to an 2FA/MFA application that does cloud
Exporting a QR code from google authenticator then taking a screenshot\pic of it and saving that for future phones has served me well so far..
I think if I read correctly, TWRP just released their new version with Android 12 decryption support, so I can go and extract it now from my nandroid backup. https://twrp.me/site/update/2022/10/10/3.7.0-released.html - did someone test this?
BTW, I also saved the 2FA codes to KeePassXC/DX, works brilliantly there too, has nice integration both on desktop and Android.
Hi,
I've finally found a way to save my current ROM and go back to my old backup of stock A11 (restore a NANDroid backup), and try to access G Auth, but it was empty straight away. Tried a restore with Neo Backup, no change. Unfortunately it seems like it's all gone. At least I have the DB file, it has a list of accounts, so I at least know where I had MFA...
Unless someone else has a clue how to restore it, someone?
Given it's finally getting cloud sync feature, Google should release a way to restore it. Google please do!
Thanks!

Categories

Resources