Questions tagged [crypt12]

"crypt12" is a file format created by WhatsApp. It contains a zlib-compresssed, byte-padded, 256-bit AES-encrypted sqlite 3.x database of a users sent and received messages.

The .crypt12 extension is often prependen by .db (.db.crypt12) indicating that it contains a database. crypt12 files are what WhatsApp uses to securely store a user's message databases on his or her Android device.
In the past WhatsApp used different formats to store the messages, such as .crypt7 or .crypt8.

To decrypt a crypt12 to view the message history of the app's user, the key file (which stores the encryption key) must be located. The key file is stored in the following location: /data/data/com.whatsapp/files/key

The crypt12 database files are located in the sdcard directory of an Android device with WhatsApp installed. You can find them in the following directory: /sdcard/WhatsApp/Databases

Common crypt12 Filenames
msgstore.db.crypt12 - Name of the file that contains the database of chat messages. The date may appear after "msgstore" in the YYYY-MM-DD format. For example: msgstore-2019-01-05.1.db.crypt12.

1 questions
9
votes
1 answer

How to generate the header and footer for WhatsApp's .crypt12 format?

WhatsApp stores all messages in an sqlite file which is first zlib compressed and then AES encrypted. Decryption/decompression can be done quite easily like that: def decrypt(db_file, key_file): """ Function decrypt Crypt12 Database """ …
Forivin
  • 14,780
  • 27
  • 106
  • 199