Description
You have a backup of a WhatsApp database and want to see what a person said during a certain stretch of time. But msgstore.db is either encrypted or uses a newer table layout, and older tools open it to a blank page.
Whapa is a WhatsApp forensics toolset written in Python, working with both Android and iOS. The current 2.00 release reads the new and the legacy database layouts alike, decrypts crypt15 backups, and recognises message types added in recent years such as polls, view-once media, edits, reactions and channels. One command builds a web report you can scroll like a chat app; double-click index.html and it opens, with no server to set up.
Each tool does one job: use them on their own from the command line, or all together from the graphical interface. The download link points to the GitHub repository; you need Python 3.11 or newer and install the dependencies after cloning it.
Database parsing: reads Android msgstore.db and iOS ChatStorage.sqlite, in the current and the legacy schema.
Backup decryption: Whacipher opens crypt12, crypt14 and crypt15, with a key file or the 64-character hexadecimal root key.
Powerful search: filter by text, regular expression, date range, sender, direction, message type, deleted, starred or forwarded, with the same engine in the command line, the GUI and the report.
Interactive report: messages load in chunks as you scroll, so a conversation with a hundred thousand messages opens quickly, and there is a printable version and a CSV export.
Attachment linking: point -mp at the WhatsApp folder you copied off the phone and images, audio and video show and play inside the report; missing files are marked as not located.
Receipts and locations: the report shows sent, delivered and read states, and locations can be exported to KML for Google Earth.
Companion tools: also includes Google Drive backup extraction, iCloud extraction, database merging and exported chat parsing.
Whapa is a WhatsApp forensics toolset written in Python, working with both Android and iOS. The current 2.00 release reads the new and the legacy database layouts alike, decrypts crypt15 backups, and recognises message types added in recent years such as polls, view-once media, edits, reactions and channels. One command builds a web report you can scroll like a chat app; double-click index.html and it opens, with no server to set up.
Each tool does one job: use them on their own from the command line, or all together from the graphical interface. The download link points to the GitHub repository; you need Python 3.11 or newer and install the dependencies after cloning it.
Features
Database parsing: reads Android msgstore.db and iOS ChatStorage.sqlite, in the current and the legacy schema.
Backup decryption: Whacipher opens crypt12, crypt14 and crypt15, with a key file or the 64-character hexadecimal root key.
Powerful search: filter by text, regular expression, date range, sender, direction, message type, deleted, starred or forwarded, with the same engine in the command line, the GUI and the report.
Interactive report: messages load in chunks as you scroll, so a conversation with a hundred thousand messages opens quickly, and there is a printable version and a CSV export.
Attachment linking: point -mp at the WhatsApp folder you copied off the phone and images, audio and video show and play inside the report; missing files are marked as not located.
Receipts and locations: the report shows sent, delivered and read states, and locations can be exported to KML for Google Earth.
Companion tools: also includes Google Drive backup extraction, iCloud extraction, database merging and exported chat parsing.
