b16f00t / whapa

WhatsApp Parser Toolset v1.59

Whatsapp Parser Toolset

Updated: May 2022

WhatsApp Messenger Version 2.21.9.14

Whapa is a set of graphical forensic tools to analyze whatsapp from Android and soon iOS devices. All the tools have been written in Python 3.8 and have been tested on linux, windows and macOS systems.

Note: Whapa provides 10x more performance and fewer bugs on linux systems than on windows.

Whapa is included as standard in distributions such as Tsurugi Linux (Digital Forensics) and BlackArch Linux (Penetration Testing).

Whapa toolset is divided in five tools:

Android

• Whapa (Whatsapp Parser)(Only working with old database, Working in Progress...)
• Whacipher (Whatsapp Encryption/Decryption) *** Not support Crypt15 ***
• Whagodri (Whataspp Google Drive Extractor)
• Whamerge (Whatsapp Merger) (Only working with old database, Working in Progress...)
• Whachat (Whatsapp Chat Exporter)

IPhone

• Whacloud (Whatsapp ICloud Extractor) (Not working)
• Whachat (Whatsapp Chat Exporter)

Do you like this project? Support it by donating

• Paypal: Donate

Changelog

https://github.com/B16f00t/whapa/blob/master/doc/CHANGELOG.md

Installation

You can download the latest version of whapa by cloning the GitHub repository:

git clone https://github.com/B16f00t/whapa.git && cd whapa

then (Linux or macOS):

pip3 install --upgrade -r ./doc/requirements.txt

or (Windows):

pip install --upgrade -r .\doc\requirements.txt

Start

if you use Linux system:

python3 whapa-gui.py

if you use Windows system:

python whapa-gui.py
or 
click on whapa-gui.bat

if you use macOS system (2 install options):

1. Install (Thanks to XuluWarrior):

    brew install python-tk
   

2. Install a later version of TK (Thanks to FetchFast):

    brew install tcl-tk
   

• Uninstall python3 and then download and reinstall python 3.9x from python.org

    brew uninstall python3
    https://www.python.org/downloads/
  

• Install requirements

    pip3 install --upgrade -r ./doc/requirements.txt
  

• Run with python3.9x whapa-gui.py

And a window like this will be displayed on the screen:

WHAPA

whapa.py is an Android whatsapp database parser which automates the process and presents the data handled by the SQLite database in a way that is comprehensible to the analyst. If you copy the "wa.db" database into the same directory as the script, the phone number will be displayed along with the name.

Please note that this project is an early stage. As such, you could find errors. Use it at your own risk!

Reports

To create reports the first thing we need to do is to configure the file"./cfg/settings.cfg". For example:

[report]
company = Foo S.L
record = 1337
unit = Research group
examiner = B16f00t
notes = Chat maintained between the murderer and the victim

If we want to put the logo of our company, we must replace the file './cfg/logo.png' by the one of our choice. In the file './cfg/settings.cfg', the name of the company or unit must be specified, as well as the assigned registration number, the unit or group we belong to, who the examiner is and we can also specify notes in the report.

To generate the report we must specify the option "English" whether we want the report in English, as well as "ES" whether we want the report in Spanish.

If you specify the "wa.db" database, the phone number will be displayed along with the name. For the report to contains the images, videos, documents... you must copy the "WhatsApp/Media" folder of your phone to the report directory, otherwise the program will generate thumbnails.

If we want to print the document or create the report in pdf, It recommends in the print option -> scale the view <= 60% or 70%, otherwise the report will be displayed too large.

WHACIPHER

whacipher.py is a tool which allows decrypt or encrypt WhatsApp database. You must have the key of your phone to decrypt, and additionally a encrypted database as reference to encrypt a new database.

WHAMERGE

whamerge is a tool to joins backups in a new database, to be able to be analyzed and obtain more information, such as deleted groups, messages, etc...

Warning: Do not join restored databases with old copies, since they repeat the same ids and the copy will not be done correctly.

WHAGODRI

whagodri.py is a tool which allows WhatsApp users on Android to extract their backed up WhatsApp data from Google Drive.

Make sure of:

• Download the latest version of whapa
• Install the requirements
• Settings:

Edit only the values of the./cfg/settings.cfg file

	[google-auth]
	gmail = [email protected]
	# Optional. The account password or app password when using 2FA.
	password  = 
	# Optional. The result of "adb shell settings get secure android_id".
	android_id = 0000000000000000
	# Optional. Enter the backup country code + phonenumber be synchronized, otherwise it synchronizes all backups.
	# You can specify a list of celnumbr = BackupNumber1, BackupNumber2, ...
	celnumbr = 

• New Method: Login by OAuth, this method is not valid for accounts without a phone number or alternative email associated to the account.
• If you request it, log in to your browser and then click here. https://accounts.google.com/b/0/DisplayUnlockCaptcha
• If you want to use 2FA (Two Factor Authentication), you will have to go to the URL: https://myaccount.google.com/apppasswords Then select Application: Other. Write down: Whapa, and a password will be display, then you must write the password in your settings.cfg. (Thanks to YuriCosta) or Login by OAuth.

WHACLOUD

whacloud.py is a tool which allows WhatsApp users on Iphone to extract their backed up WhatsApp data from ICloud. BETA TOOL May contain bugs.

Make sure of:

• Download the latest version of whapa
• Install the requirements
• Settings:

Edit only the values of the./cfg/settings.cfg file

	[icloud-auth]
	icloud = [email protected]
	passw = yourpassword

WHACHAT

whachat.py is a tool to make an interactive report from whatsapp's export chat functionality.

To export chats on an Android phone, here are the steps:

1. Open the individual or group chat.
2. Press the Menu button.
3. Press More.
4. Select Export chat.
5. Choose Include or Exclude files.

To export chats on an iOS phone, here are the steps:

1. Open the individual or group chat.
2. Press on the name (Chat information).
3. Slide down.
4. Select Export chat.
5. Choose Include or Exclude files.

Get in touch

Acknowledgements, suggestions, languages, improvements...

Telegram Channel and discuss group

https://t.me/bigfoot_whapa

Disclaimer

The developer is not responsible, and expressly disclaims all liability for damages of any kind arising from the use, reference or reliance on the software. The information provided by the software is not guaranteed to be correct, complete and up-to-date.

whapa's Issues

Modify database file

Hey, great project! Is there an easy way to re-encrypt a decrypted database. For instance if I decrypted the database and replaced all swear words with "****" in all messages, how could I get it back into the format that WhatsApp itself would understand?

From what I understand this is the function responsible for decrypting everything:

def decrypt(db_file, key_file):
    """ Function decrypt Crypt12 Database """
    try:
        with open(key_file, "rb") as fh:
            key_data = fh.read()

        key = key_data[126:]
        with open(db_file, "rb") as fh:
            db_data = fh.read()

        iv = db_data[51:67]
        aes = AES.new(key, mode=AES.MODE_GCM, nonce=iv)
        with open("msgstore.db", "wb") as fh:
            fh.write(zlib.decompress(aes.decrypt(db_data[67:-20])))

        print db_file + " decrypted, msgstore.db created."
    except Exception as e:
print "An error has ocurred decrypting the Database:", e

But I don't fully understand whats happening here. It looks like you would need msgstore.db, key_data[126:] as well as db_data[0:51] (whatever that is), db_data[51:67] (iv / nonce param for aes) and db_data[-20:] (whatever that is) from a encrypted db to encrypt a decrypted msgstore.db.

Am I correct so far? Can I just copy db_data[0:51], db_data[51:67] and db_data[-20:] from an original encrypted database or are they some sort of checksums that I have to calculate? If so, can you show me how?

This is what I would imagine it to look like:

def encrypt(msgstore_db_file, key_file, db_file_to_use_as_reference):
    """ Function encrypt msgstore Database """
    try:
        with open(key_file, "rb") as fh:
            key_data = fh.read()

        key = key_data[126:]

        with open(msgstore_db_file, "rb") as fh:
            msgstore_data = fh.read()

        with open(db_file_to_use_as_reference, "rb") as fh:
            ref_db_data = fh.read()

        header = ref_db_data[0:51]
        iv = ref_db_data[51:67]
        footer = ref_db_data[-20:]

        aes = AES.new(key, mode=AES.MODE_GCM, nonce=iv)
        with open("wa.db", "wb") as fh:
            fh.write(header + iv + aes.encrypt(zlib.compress(msgstore_data)) + footer)

        print db_file + " encrypted, wa.db created."
    except Exception as e:
print "An error has ocurred encrypting the Database:", e

I'd really appreciate it if you could help me figure this out.

Error=NeedsBrowser

The following message (with different plt) keeps coming even after google says:

Account access enabled

Please try signing in to your Google account again from your new device or application.

The message:

     __      __.__             ________      ________        .__ 
    /  \    /  \  |__ _____   /  _____/  ____\______ \_______|__|
    \   \/\/   /  |  \\__  \ /   \  ___ /  _ \|    |  \_  __ \  |
     \        /|   Y  \/ __ \\    \_\  (  <_> )    `   \  | \/  |
      \__/\  / |___|  (____  /\______  /\____/_______  /__|  |__|
           \/       \/     \/        \/              \/          

    ------------ Whatsapp Google Drive Extractor v0.1 ------------
    
[i] Searching...

Error=NeedsBrowser
Url=https://accounts.google.com/signin/continue?sarp=1&scc=1&continue=https://accounts.google.com/o/android/auth?hl%3Den%26xoauth_display_name%3DAndroid%2BLogin%2BService%26source%3DAndroid%2BLogin&plt=A******************************************************************************************************************************************v
ErrorDetail=To access your account, you must sign in on the web. Touch Next to start browser sign-in.

Whagodri: previous backups not visible

Hi there!

Sadly my girlfriend managed to overwrite her 1GB big WhatsApp backup of a few years in her Google Drive Account with a new backup of the last few days. It seems that Android Oreo causes the WhatsApp Backup Restore function too malfunction badly, only allowing users (that don't read the screen too much before clicking buttons...) to setup a new backup into Google Drive without restoring the old one.

Now her Google Drive Account still shows "Hidden app data: 1 GB" under https://drive.google.com -> Settings -> Manage Apps -> WhatsApp Messenger
So I had hoped that the data still is stored somewhere, which is why I tried to get your whagodri.py script running, but sadly, I can only see the tiny new backup:

kaefert@mint ~/Downloads/android/whapa $ python2 whagodri.py -l

     __      __.__             ________      ________        .__ 
    /  \    /  \  |__ _____   /  _____/  ____\______ \_______|__|
    \   \/\/   /  |  \\__  \ /   \  ___ /  _ \|    |  \_  __ \  |
     \        /|   Y  \/ __ \\    \_\  (  <_> )    `   \  | \/  |
      \__/\  / |___|  (____  /\______  /\____/_______  /__|  |__|
           \/       \/     \/        \/              \/          

    ------------ Whatsapp Google Drive Extractor v0.1 ------------
    
[i] Searching...

[+] Backup ID: 0
    [+] Number: 1 / 0
        [-] File    : Databases/msgstore.db.crypt12
        [-] Hash MD5: 0eef660a7cb43cc32e41343b81da63e2
        [-] Request : 1Bi4CGXZfTq1xSmA6IEjuCYpdKghy3_4Rm1oTpbfATg4LSMREGQ
        [-] Size    : 52793 Bytes (51.56 KB)

    [+] Number: 2 / 0
        [-] File    : Media/WhatsApp Images/IMG-20180531-WA0000.jpg
        [-] Hash MD5: 5bc0c4d2ca9b8357deb4d3a1703fc550
        [-] Request : 1HBvc9oBJAhSoYnMhVzxGv-Kqpwe3A3hrlw4
        [-] Size    : 105391 Bytes (102.92 KB)

Can you help me? Do you know of any way that might enable me to find the overwritten backup in there?

Missing column

Hi.

I tried merging 2 backups with Whademe and the script threw error about missing columns. The columns were located in chatlist and started with "deleted_". However the older backup had them. I added the colums manually to new backup and the error didn't appear anymore. I tried restoring the database but it was corrupted.

'deleted_message_id','deleted_starred_message_id', 'deleted_message_categories'

[e] Unable to locate google drive file map for: com.whatsapp RESPONSE 404

Hi!

I have already done the following steps and verified that the phone number is correct;

Disable 2FA in your Google Account
Download the latest version of whagodri.py
Install the requirements
Configure:
Edit only the values of the./cfg/settings.cfg file
[auth]
gmail = [email protected]
passw = yourpassword
devid = Device ID (optional, if specified get more information)
celnumbr = BackupPhoneNumber (ex. 3466666666666, [Country Code] + Phone Number "no +, nor 00")
Use on a terminal: python3 whagdext.py -list
If you request it, log in to your browser and then click here, https://accounts.google.com/DisplayUnlockCaptcha.
If it lists all the files in the account then try the '-sync' flag.

But the error still here..
It worked until 10 days ago

Additional info:

WIN 10
UPDATED PYTHON (3.7)

Error

Hi, I ran into this error. How do I fix it?

[e] Error: Requested entity was not found.
[e] Unable to locate google drive file map for: com.whatsapp <Response [404]>
[i] Generating threads...
Traceback (most recent call last):
File ".\libs\whagodri.py", line 313, in
getMultipleFiles(drives, bearer, files)
File ".\libs\whagodri.py", line 166, in getMultipleFiles
print("[+] Backup name : {}".format(drives["name"]))
KeyError: 'name'

Can we use this tool to download apps backup file?

Can we use this tool to download apps backup file? i have tried by removing cell number it won't connect. I need tool that downloads apps data which backup in gdrive

Key Error

It is showing invalid key.

Unable to locate google drive file map for: com.whatsapp

I tried many solutions and follow every guide but i am getting this error "Unable to locate google drive file map for: com.whatsapp" every time .

Every thing was working fine before .I am getting this error from some days .I think google or whatsapp changed the policies .

Kindly handle this issue.

com.whatsapp <Response [200]>

No Google Drive backup: 'files'
[e] Unable to locate google drive file map for: com.whatsapp <Response [200]>
[-] Backup name : clients/wa/backups/5216441720530
[-] Backup upload : 2020-01-12T20:42:18.998Z
[i] Error 'sizeBytes'

Where is the problem? :)

DeviceManagementRequiredOrSyncDisabled on Gsuite accounts

When i use a gsuite account i receive this message:

Error=DeviceManagementRequiredOrSyncDisabled

Unable to locate google drive file map for: com.whatsapp

Hi!

I received this error message when trying to run the script.

Every configuration seems to be in order.

O tried usng postman to run the same request that your function makes to get the file map from google drive.
I dont get any errors from the google api, but the items array comes empty

I already checked if the backup is present in my google drive for the same avccount and it is there.

any thoughts?

does the script still working?

I've used whatsappgdextract for some time ago (last time I used it, it worked) and suddenly it doesn't work anymore so I try this script and the result is still the same, " Unable to locate google drive file map for: com.whatsapp "

Hi @hndrk92 , can you help me with this massage ? i have 3.7.5 version and the requirements are installed. who can i make it work ?

Hi @hndrk92 , can you help me with this massage ? i have 3.7.5 version and the requirements are installed. who can i make it work ?

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
File ".\libs\whagodri.py", line 258, in
getConfigs()
File ".\libs\whagodri.py", line 65, in getConfigs
except(ConfigParser.NoSectionError, ConfigParser.NoOptionError):
AttributeError: type object 'ConfigParser' has no attribute 'NoSectionError'`

Originally posted by @ronitu22 in #1 (comment)

How to extract the key?

Cómo se puede extraer el key para poder desencriptar una base de datos .crypt12?

Problem using Whagodri

Hi, I have installed Python 3.8.1, and the installation of requirements was ok.
Now when I try to make any action on the Whagodri TAB always the same error appears on the terminal:

[i] Searching...

Traceback (most recent call last):
  File "C:\Program Files (x86)\Python38-32\lib\configparser.py", line 789, in ge
t
    value = d[option]
  File "C:\Program Files (x86)\Python38-32\lib\collections\__init__.py", line 89
1, in __getitem__
    return self.__missing__(key)            # support subclasses that define __m
issing__
  File "C:\Program Files (x86)\Python38-32\lib\collections\__init__.py", line 88
3, in __missing__
    raise KeyError(key)
KeyError: 'devid'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File ".\libs\whagodri.py", line 58, in getConfigs
    devid = config.get('auth', 'devid')
  File "C:\Program Files (x86)\Python38-32\lib\configparser.py", line 792, in ge
t
    raise NoOptionError(option, section)
configparser.NoOptionError: No option 'devid' in section: 'auth'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File ".\libs\whagodri.py", line 258, in <module>
    getConfigs()
  File ".\libs\whagodri.py", line 65, in getConfigs
    except(ConfigParser.NoSectionError, ConfigParser.NoOptionError):
AttributeError: type object 'ConfigParser' has no attribute 'NoSectionError'

I'm not even a dummy with Python, so I can't understand what's happening.
Anyone can help me?

Thanks in advance

[e] Unable to locate google drive file map for: com.whatsapp

This only appeared lately, is this a change on google's side?

Invalid syntax

whademe.py
File "D:\whapa-master\whademe.py", line 53
------------ Whatsapp Decrypter and Merger v""" + version + """ ------------
^
SyntaxError: invalid syntax

Windows 10 x64 + Python 3.6

OSError: Cannot load native module 'Cryptodome.Hash._MD5': Trying '_MD5.pyd': [Error 193] %1 is not a valid Win32 application

When i try to run whagodri.py, I get the following issue:

Traceback (most recent call last):
File "whagodri.py", line 4, in
from gpsoauth import google
File "C:\Python27\lib\site-packages\gpsoauth_init_.py", line 4, in
from . import google
File "C:\Python27\lib\site-packages\gpsoauth\google.py", line 4, in
from Cryptodome.PublicKey import RSA
File "C:\Python27\lib\site-packages\Cryptodome\PublicKey\RSA.py", line 38, in
< module>
from Cryptodome.IO import PKCS8, PEM
File "C:\Python27\lib\site-packages\Cryptodome\IO\PKCS8.py", line 44, in
from Cryptodome.IO._PBES import PBES1, PBES2, PbesError
File "C:\Python27\lib\site-packages\Cryptodome\IO_PBES.py", line 43, in
from Cryptodome.Hash import MD5, SHA1
File "C:\Python27\lib\site-packages\Cryptodome\Hash\MD5.py", line 47, in
""")
File "C:\Python27\lib\site-packages\Cryptodome\Util_raw_api.py", line 258, in
load_pycryptodome_raw_lib
raise OSError("Cannot load native module '%s': %s" % (name, ", ".join(attemp
ts)))
OSError: Cannot load native module 'Cryptodome.Hash._MD5': Trying '_MD5.pyd': [E
rror 193] %1 is not a valid Win32 application

Is there anyone get same issue ? How do i repair this ?
Thanks

KeyError item

Hi, I have the following error {u'error ': {u'code': 400, u'message ': u'Invalid query', u'errors': [{u'locationType ': u'parameter', u'domain ': u'global', u'message ': u'Invalid query', u'reason ': u'invalid', u'location ': u'q'}]}}
{
"error": {
"errors": [
{
"domain": "global",
"reason": "invalid",
"message": "Invalid query",
"locationType": "parameter",
"location": "q"
}
],
"code": 400,
"message": "Invalid query"
}
}

Traceback (most recent call last):
File "whagodri.py", line 287, in
drives = gDriveFileMap ()
File "whagodri.py", line 150, in gDriveFileMap
for result in jres ['items']:
KeyError: 'items'

Could you help me solve it? Thanks

% in the Password result in error

I had a "%" and a "!" in my password. When I change both special characters to "!" it works.

Just want you to know that. Perhaps you can fix this in later releases.

THX a lot for this tool!

Is whagodri down?

Been using whagodri.py (without the whapa gui, it's not working for me for some reason) for months without any problem, today I got this

issueAdvice=auto
Expiry=1585623190
ExpiresInDurationSec=3599
storeConsentRemotely=1
isTokenSnowballed=1
grantedScopes=https://www.googleapis.com/auth/drive.appdata https://www.googleapis.com/auth/drive.file
Auth=ya29.a0Adw1xeUPP7zm3e9RJcb4UzffpOCB78vHqC0CdVeZysb-735n938R_Amj3oSyUTzE3ZHlS4qrVBrv6SF2GT0jEM9n2mazfezlz2KLaw_PieqGS6jBiirttq6HBJaSfMS5XNyx2eqqy29KOGasu49qNoDuHZRZYr-dOYw

Nothing changed on my end, what does it mean?
Thanks

how can i use it on c#

seems to work but this happens:

everything seems to work fine, but nothing is really happening. this is what the program replies:

issueAdvice=auto
Expiry=1588959205
ExpiresInDurationSec=3272
storeConsentRemotely=1
isTokenSnowballed=1
grantedScopes=https://www.googleapis.com/auth/drive.appdata [url]https://www.googleapis.com/auth/drive.file[/url]...... and a long key here.

anyone have any idea how to solve this?

makedirs error

Windows 10
git Bash
1,3 GB Backup.

    [+] Number: 4135 / 4156
        [-] Thread-06=> Downloaded: 'WhatsApp\Media\WhatsApp Voice Notes\201550\PTT-20151206-WA0008.aac'

[i] Downloads finished
makedirs
    mkdir(name, mode)
WindowsError: [Error 183] Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist: u'WhatsApp\\Media\\WhatsApp Images'

Exception in thread Thread-31:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 801, in __bootstrap_inner
    self.run()
  File "whagodri.py", line 179, in run
    process_data(self.name, self.q)
  File "whagodri.py", line 188, in process_data
    getMultipleFilesThread(data['bearer'], data['entries_r'], data['local'], data['entries_m'], threadName)
  File "whagodri.py", line 198, in getMultipleFilesThread
    os.makedirs(os.path.dirname(local))
  File "C:\Python27\lib\os.py", line 157, in makedirs
    mkdir(name, mode)
WindowsError: [Error 183] Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist: u'WhatsApp\\Media\\WhatsApp Images\\Sent'





Exception in thread Thread-39:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 801, in __bootstrap_inner
    self.run()
  File "whagodri.py", line 179, in run
    process_data(self.name, self.q)
  File "whagodri.py", line 188, in process_data
    getMultipleFilesThread(data['bearer'], data['entries_r'], data['local'], data['entries_m'], threadName)
  File "whagodri.py", line 198, in getMultipleFilesThread
    os.makedirs(os.path.dirname(local))
  File "C:\Python27\lib\os.py", line 157, in makedirs
    mkdir(name, mode)
WindowsError: [Error 183] Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist: u'WhatsApp\\Media\\WhatsApp Images'

Exception in thread Thread-23:
Traceback (most recent call last):
  File "C:\Python27\lib\threading.py", line 801, in __bootstrap_inner
    self.run()
  File "whagodri.py", line 179, in run
    process_data(self.name, self.q)
  File "whagodri.py", line 188, in process_data
    getMultipleFilesThread(data['bearer'], data['entries_r'], data['local'], data['entries_m'], threadName)
  File "whagodri.py", line 198, in getMultipleFilesThread
    os.makedirs(os.path.dirname(local))
  File "C:\Python27\lib\os.py", line 157, in makedirs
    mkdir(name, mode)
WindowsError: [Error 183] Eine Datei kann nicht erstellt werden, wenn sie bereits vorhanden ist: u'WhatsApp\\Media\\WhatsApp Images'



Carsten@Carsten-PC MINGW64 /d/Download/whapa-master/whapa-master
$ py -2 whagodri.py -h

     __      __.__             ________      ________        .__
    /  \    /  \  |__ _____   /  _____/  ____\______ \_______|__|
    \   \/\/   /  |  \\__  \ /   \  ___ /  _ \|    |  \_  __ \  |
     \        /|   Y  \/ __ \\    \_\  (  <_> )    `   \  | \/  |
      \__/\  / |___|  (____  /\______  /\____/_______  /__|  |__|
           \/       \/     \/        \/              \/

    ------------ Whatsapp Google Drive Extractor v0.1 ------------

usage: whagodri.py [-h] [-i | -l | -lw | -p FilePath BackupID | -s] [-f]

Extract your Whatsapp files from Google Drive

optional arguments:
  -h, --help            show this help message and exit
  -i, --info            Show information about Whatsapp backups
  -l, --list            List all available files
  -lw, --list_whatsapp  List Whatsapp backups
  -p FilePath BackupID, --pull FilePath BackupID
                        Pull a file from Google Drive
  -s, --sync            Sync all files locally
  -f, --flush           Flush log file to sync from the beginning

Windows could not connect to the group policy client service

When i logon to my computer this message appears to me in the toolbar "Windows could not connect to the group policy client service"
And when i try to open my computer folder or any thing this message appears to me "The device is not ready"
Please help me guys

zlib error incorrect header check

I'm trying to decrypt a database from an old backup. However the backup inexplicably didn't have the key.
After reading issue #11 I proceeded to generate a new key.
So I restored the app and the data with TitaniumBackup and the old Whatsapp folder with the database to the root of the sd card.
This allowed Whatsapp to access the database after verifying with SMS and created a key in /data. However I am unable to proceed past the zlib decompression phase.

I notice the IV comes from the data. Does that need to also change or something when a new key is generated?

Other backups that had the key decrypt just fine.

Oh and thanks a bunch for making this awesome tool 😃

Add Feature: Enable to download any appdata from drive

Hey there,
This work great. Can you add a feature to download custom package files?
Like way back HIKE had some appdata backup on drive and i want to try fetching it.
I tried this script but it seems to not working giving 403 forbidden error.
I don't think it is maintained anymore.

Error: Unable to locate google drive file map for: com.whatsapp

I think this error is a new thing, I have my config file configured properly, the google security captcha signed in, no double Auth Error.
I was using an older code similar to this one called WhatsappExtractorand presented the exact same issue.
I assume google changed some sec settings from google drive

Whagodri: [e] Unable to locate google drive file map for: com.whatsapp

Hi
I'm trying to download a backup previously marked as "deactivated" on google drive. Launching whagodri -s automatically makes the backups "active" again on GD but I have this error ([e] Unable to locate google drive file map for: com.whatsapp) and can't download anything.
I've setted my settings.cfg with username, password, a devid of a android phone and the cellnumber in this form "390000000000" (with the real number and not the zeros obv). What can I do?

Chat DB Size 0

Hello,
When I run "python whagodri.py -i" this shows up:

 __      __.__             ________      ________        .__ 
/  \    /  \  |__ _____   /  _____/  ____\______ \_______|__|
\   \/\/   /  |  \\__  \ /   \  ___ /  _ \|    |  \_  __ \  |
 \        /|   Y  \/ __ \\    \_\  (  <_> )    `   \  | \/  |
  \__/\  / |___|  (____  /\______  /\____/_______  /__|  |__|
       \/       \/     \/        \/              \/          

-------------- Whatsapp Google Drive Extractor --------------

[i] Searching...

[-] Backup name : clients/wa/backups/{myPhoneNumber}
[-] Backup upload : 2020-01-14T10:06:21.207304Z
[-] Backup size : 7975615269 Bytes (7606.14 MB)
[+] Backup metadata
[-] Backup Frequency : 1
[-] Backup Network Settings : 0
[-] Backup Version : 1
[-] Include Videos In Backup : True
[-] Num Of Photos : 24169
[-] Num Of Media Files : 30555
[-] Num Of Messages : 953684
[-] Video Size : 3182997101 Bytes (3035.54 MB)
[-] Backup Size : 7975615269 Bytes (7606.14 MB)
[-] Media Size : 7974765941 Bytes (7605.33 MB)
[-] Chat DB Size : 0 Bytes (0.00 KB)

"Chat DB Size" is 0 Bytes, but Num Of Messages is 953684.
How can I restore my chat?
When pulling everything, the only things I get are:

 __      __.__             ________      ________        .__ 
/  \    /  \  |__ _____   /  _____/  ____\______ \_______|__|
\   \/\/   /  |  \\__  \ /   \  ___ /  _ \|    |  \_  __ \  |
 \        /|   Y  \/ __ \\    \_\  (  <_> )    `   \  | \/  |
  \__/\  / |___|  (____  /\______  /\____/_______  /__|  |__|
       \/       \/     \/        \/              \/          

-------------- Whatsapp Google Drive Extractor --------------

[i] Searching...

[+] Backup name : clients/wa/backups/{myPhoneNumber}
[-] File 1/30559 : Backups/chatsettingsbackup.db.crypt1
[-] File 2/30559 : Backups/statusranking.db.crypt1
[-] File 3/30559 : Backups/stickers.db.crypt1

All the other stuff is Media.

Any solution?
Thanks

Can I use that with the Windows Phone Backup

Can I use this with the Windows Phone Backup with the extension db?

problem installing requirements

Hi, I'm using Python38-32 with PIP 19.2.3 and I'm getting error:

Any ideas what's wrong? I'm using windows 7 pro but *uck it :)

Error -3 while decompressing data incorrect header check

Hi there.

I started to get this error:

Error -3 while decompressing data incorrect header check
while trying to decript the database extracted.
I changed the device in which whatsapp is installed for this number, but read that it doesnt matter for the key that i've retrived using root access.

Any thougths?

Download only Images folder

How i can download only images folder or only images sent?

Incorrect merging

Hello Ivan,

Thank you for your scripts :)

I took a look into your code and I am pretty sure the way of merging message is not working correctly in some cases since "_id" restart from the beginning on every new phone/backup.
It is a good check to avoid duplicating message but not merge two backups from the same number coming from two phones used successively without importing the previous backup.

Give a check here to see:
https://github.com/namnoops/merjapp/blob/649b95948fa547552b280ca90b280ae4aa6987da/src/com/merjapp/Merge.java#L215-L219

Kind regards,
Nico

error running script

Hi, despite all the requirements successfully installing, i'm getting the error below when i run python3 whapa-gui.py. Using Ubuntu 18.04.

Unable to locate google drive file map for: com.whatsapp urgent help!!

I do not longer have the same phone number I used on my WhatsApp account, I had to beg an stranger to give me the verification code in order to get my account back. For some reason I wasn't able to restore my messages nor from my phone database nor from google drive database. Since someone else already had my number I didn't want to try again by uninstalling and restalling so I changed the number on the account right away. When I did it, again non of my messages nor my contacts restored. Now the database on my phone is gone but I still have the one on drive with my previous number. I have been trying this method to at least have access to my old messages but im getting the "Unable to locate google drive file map for: com.whatsapp" error. I dont know if I should write in the settings.cfg my actual or previous phone number (the one in the drive database), either way none of them seem to be working as I get the same error. I still have the same phone so I guess the devid is the same as it was before. English is not my first language and I know nothing about programming but getting my messages back is really important to me, any help you can give will be greatly appreciated!

Unable to start Whapa because of tkinter module on Linux Mint 19.2 (Tina) MATE

matheus@matheus-CL341:~/Downloads/Persepolis/Compressed/whapa-master$ pip3 install -r ./doc/requirements.txt
Collecting pycryptodome (from -r ./doc/requirements.txt (line 1))
  Downloading https://files.pythonhosted.org/packages/41/43/1598eb29a97cfbeb370f09936c64add9109a764acf30fd3ff876b5d3f8ed/pycryptodome-3.9.1-cp36-cp36m-manylinux1_x86_64.whl (9.7MB)
    100% |████████████████████████████████| 9.7MB 67kB/s 
Collecting colorama (from -r ./doc/requirements.txt (line 2))
  Using cached https://files.pythonhosted.org/packages/4f/a6/728666f39bfff1719fc94c481890b2106837da9318031f71a8424b662e12/colorama-0.4.1-py2.py3-none-any.whl
Collecting configparser (from -r ./doc/requirements.txt (line 3))
  Using cached https://files.pythonhosted.org/packages/7a/2a/95ed0501cf5d8709490b1d3a3f9b5cf340da6c433f896bbe9ce08dbe6785/configparser-4.0.2-py2.py3-none-any.whl
Collecting gpsoauth (from -r ./doc/requirements.txt (line 4))
Collecting pycryptodomex>=3.0 (from gpsoauth->-r ./doc/requirements.txt (line 4))
  Downloading https://files.pythonhosted.org/packages/d1/b9/4583d5b6a15a8213d21f24f0d1faa71951b64555b4860612df8eef696d24/pycryptodomex-3.9.1-cp36-cp36m-manylinux1_x86_64.whl (9.7MB)
    100% |████████████████████████████████| 9.7MB 63kB/s 
Collecting requests (from gpsoauth->-r ./doc/requirements.txt (line 4))
  Using cached https://files.pythonhosted.org/packages/51/bd/23c926cd341ea6b7dd0b2a00aba99ae0f828be89d72b2190f27c11d4b7fb/requests-2.22.0-py2.py3-none-any.whl
Collecting chardet<3.1.0,>=3.0.2 (from requests->gpsoauth->-r ./doc/requirements.txt (line 4))
  Using cached https://files.pythonhosted.org/packages/bc/a9/01ffebfb562e4274b6487b4bb1ddec7ca55ec7510b22e4c51f14098443b8/chardet-3.0.4-py2.py3-none-any.whl
Collecting idna<2.9,>=2.5 (from requests->gpsoauth->-r ./doc/requirements.txt (line 4))
  Using cached https://files.pythonhosted.org/packages/14/2c/cd551d81dbe15200be1cf41cd03869a46fe7226e7450af7a6545bfc474c9/idna-2.8-py2.py3-none-any.whl
Collecting certifi>=2017.4.17 (from requests->gpsoauth->-r ./doc/requirements.txt (line 4))
  Using cached https://files.pythonhosted.org/packages/18/b0/8146a4f8dd402f60744fa380bc73ca47303cccf8b9190fd16a827281eac2/certifi-2019.9.11-py2.py3-none-any.whl
Collecting urllib3!=1.25.0,!=1.25.1,<1.26,>=1.21.1 (from requests->gpsoauth->-r ./doc/requirements.txt (line 4))
  Using cached https://files.pythonhosted.org/packages/e0/da/55f51ea951e1b7c63a579c09dd7db825bb730ec1fe9c0180fc77bfb31448/urllib3-1.25.6-py2.py3-none-any.whl
Installing collected packages: pycryptodome, colorama, configparser, pycryptodomex, chardet, idna, certifi, urllib3, requests, gpsoauth
Successfully installed certifi-2019.9.11 chardet-3.0.4 colorama-0.4.1 configparser-4.0.2 gpsoauth-0.4.1 idna-2.8 pycryptodome-3.9.1 pycryptodomex-3.9.1 requests-2.22.0 urllib3-1.25.6
matheus@matheus-CL341:~/Downloads/Persepolis/Compressed/whapa-master$ python3 whapa-gui.py
Traceback (most recent call last):
  File "whapa-gui.py", line 5, in <module>
    from tkinter import *
ModuleNotFoundError: No module named 'tkinter'
matheus@matheus-CL341:~/Downloads/Persepolis/Compressed/whapa-master$ pip3 install tkinter
Collecting tkinter
Exception:
Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/usr/lib/python3/dist-packages/pip/commands/install.py", line 353, in run
    wb.build(autobuilding=True)
  File "/usr/lib/python3/dist-packages/pip/wheel.py", line 749, in build
    self.requirement_set.prepare_files(self.finder)
  File "/usr/lib/python3/dist-packages/pip/req/req_set.py", line 380, in prepare_files
    ignore_dependencies=self.ignore_dependencies))
  File "/usr/lib/python3/dist-packages/pip/req/req_set.py", line 554, in _prepare_file
    require_hashes
  File "/usr/lib/python3/dist-packages/pip/req/req_install.py", line 278, in populate_link
    self.link = finder.find_requirement(self, upgrade)
  File "/usr/lib/python3/dist-packages/pip/index.py", line 465, in find_requirement
    all_candidates = self.find_all_candidates(req.name)
  File "/usr/lib/python3/dist-packages/pip/index.py", line 423, in find_all_candidates
    for page in self._get_pages(url_locations, project_name):
  File "/usr/lib/python3/dist-packages/pip/index.py", line 568, in _get_pages
    page = self._get_page(location)
  File "/usr/lib/python3/dist-packages/pip/index.py", line 683, in _get_page
    return HTMLPage.get_page(link, session=self.session)
  File "/usr/lib/python3/dist-packages/pip/index.py", line 795, in get_page
    resp.raise_for_status()
  File "/usr/share/python-wheels/requests-2.18.4-py2.py3-none-any.whl/requests/models.py", line 935, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 404 Client Error: Not Found for url: https://pypi.org/simple/tkinter/
matheus@matheus-CL341:~/Downloads/Persepolis/Compressed/whapa-master$ 

wagodri - can't recover a probably incomplete backup

I'm trying to recover a backup from an old device that was probably interrupted before it finished. I can see the backup on the google drive webpage, but the app gives me those errors:

[e] No Google Drive backup: 'files'                                                                                    
[e] Unable to locate google drive file map for: com.whatsapp <Response [200]>  
[-] Backup name   : clients/wa/backups/*number*
[-] Backup upload : *date*
[i] Error 'sizeBytes'

As you can see, even the app confirms the existence of the backup but cannot find the files. Those files must be somewhere in gdrive because the backup was almost complete when I turned off and then resetted the device (in fact, I even thought it was finished).
I think the app should be able to handle these situations.

Thank you in advance

-sync problem Unable to locate google drive file map for: com.whatsapp

i have notify
whagdext.py -sync
Unable to locate google drive file map for: com.whatsapp

geting BadAuthentication Error

Unable to locate google drive file map for: com.whatsapp

Hello, im getting this error "Unable to locate google drive file map for: com.whatsapp" after putting the sync commend but it was working fine 1 week ago. What can the problem be?
Thank you

Download File List being limited to 5000

Cant find download file

it's saying

[i] Searching...

[e] Error: Requested entity was not found.
[e] Unable to locate google drive file map for: com.whatsapp <Response [404]>
[i] Generating threads...
[+] Backup name : clients/wa/backups/92**********
[i] Downloads finished

but i am unable to find the downloaded file, there is no downloaded file in main folder

Unable to locate google drive file map for: com.whatsapp <Response [200]>

I've tested this on multiple backups and accounts. A few work, but the majority bring up this error
Unable to locate google drive file map for: com.whatsapp <Response [200]>

I'm not certain about this but I think older backups (I tested one from february 2019) work. But the newer ones are not finding the backup. Must be a google update?

Whagodri won't download anymore.

When I press the download button I get this at the bottom of the window:
python .\libs\whagodri.py -s -o "My path to the Whatsapp Parser Toolset folder"
Was working fine until yesterday, and nothing changed on my system.

another Google Backup

i like the application that can download and read whatsapp Backup
but i'm asking you ,is there a way to download the Android Phone Backup that beside the whatsapp Backup ,do u have a solution for it?

SyntaxError: Missing parentheses in call to 'print'. Did you mean print("Unit tests have failed!")?

user@user-PC MINGW64 /d/Download/whapa-master/whapa-master
$ pip install -r ./doc/requirements.txt
Collecting pycryptodome (from -r ./doc/requirements.txt (line 1))
  Using cached https://files.pythonhosted.org/packages/cf/5d/8712c03b122bbd53ce9b5471f4333bb3d7b6aa8a62b7a64bfecfe264235b/pycryptodome-3.7.0-cp37-cp37m-win_amd64.whl
Collecting colorama (from -r ./doc/requirements.txt (line 2))
  Using cached https://files.pythonhosted.org/packages/0a/93/6e8289231675d561d476d656c2ee3a868c1cca207e16c118d4503b25e2bf/colorama-0.4.0-py2.py3-none-any.whl
Collecting BeautifulSoup (from -r ./doc/requirements.txt (line 3))
  Using cached https://files.pythonhosted.org/packages/1e/ee/295988deca1a5a7accd783d0dfe14524867e31abb05b6c0eeceee49c759d/BeautifulSoup-3.2.1.tar.gz
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "C:\Users\USERNAME\AppData\Local\Temp\pip-install-5rp5k6sp\BeautifulSoup\setup.py", line 22
        print "Unit tests have failed!"
                                      ^
    SyntaxError: Missing parentheses in call to 'print'. Did you mean print("Unit tests have failed!")?

Command "python setup.py egg_info" failed with error code 1 in C:\Users\USERNAME\AppData\Local\Temp\pip-install-5rp5k6sp\BeautifulSoup\

user@user-PC MINGW64 /d/Download/whapa-master/whapa-master

Unable to locate google drive file map for : Com.Whatsapp

Hello Team,

I'm new to this site and I have searched for few options where I could download the backup whatsapp data from the google drive and that's how I came to know from one of the youtuber about the WhatsappGDExtract. I did everything installed up to date and tried it with one of my account which did not work and came out with this message as " Unable to locate google drive file map for : Com.Whatsapp. But the same I tried with my different account which worked. Please help me out in recovering the data. Where could the problem be ..?