01Location
- /data/data/com.whatsapp/databases/msgstore.db (+ -wal, -shm)
- Media: …/WhatsApp/Media/ on shared storage or …/com.whatsapp/files/Media/
- Encrypted backup copies: …/WhatsApp/Databases/msgstore.db.cryptNN
02Questions it answers
- Who did the account exchange messages with, in which chats, and when?
- Which media files and locations were sent or received?
- Which WhatsApp calls were made or received and for how long?
- Which groups and channels did the account belong to?
03Format and versions
| Format | SQLite. Modern schema: message, chat, jid (raw_string), jid_map (LID → phone JID), message_media, message_location, call_log, newsletter. Legacy schema: messages (key_remote_jid, key_from_me, data) with group_participants. |
|---|---|
| Applies to | ALEAPP found the legacy messages table only on its older Android 11/12 test images; newer databases use message and may key chats by LID JIDs (…@lid) resolved through jid_map. |
04Key fields
| Field | What it tells you |
|---|---|
| message.chat_row_id → chat.jid_row_id → jid.raw_string | Chat JID; groups end in @g.us, channels in @newsletter. |
| message.from_me / sender_jid_row_id | Direction (1 outgoing) and sender in group chats. |
| message.text_data / message_type | Text body and message type code (ALEAPP labels only some values). |
| message_media.file_path / file_size | Media path and size. |
| message_location | Shared/live location data including live_location_final_timestamp. |
| call_log | timestamp, duration, from_me, jid_row_id, group_jid_row_id. |
| chat.subject / created_timestamp | Group or channel subject and chat creation value. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| message.timestamp | Unix epoch, milliseconds | Message time; 0 means no value. |
| message.received_timestamp | Unix epoch, milliseconds | Receipt time on the device; 0 means none. |
| call_log.timestamp / duration | Unix ms / seconds | Call end is computed as start + duration; it is not stored. |
| chat.created_timestamp | Unix epoch, milliseconds | Whether this marks group creation or chat creation on this device is not established. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Preserve msgstore.db, wa.db, WAL files and the media folders together.
- Identify the schema (message vs messages) and whether jid_map exists.
- Resolve chat and sender JIDs, mapping LID JIDs through jid_map, then attach names from wa.db.
- Convert millisecond timestamps and match media paths to files.
- Separate one-to-one, group and channel chats in reporting.
07Interpretation pitfalls
- The @g.us group convention is cited from a third-party client (whatsmeow), not from WhatsApp documentation.
- Channel messages carried sender_jid_row_id 0 on test images, so no author is recorded.
- Schema changes frequently between app versions; verify tables and columns on each database.
- Recent activity may be in the WAL file only.
09Sources
- ALEAPP — scripts/artifacts/WhatsApp.py Alexis Brignoni et al. (GitHub) · checked 2026-10-14
- WhatsApp in Plain Sight: Where and How You Can Collect Forensic Artifacts Igor Mikhailov, Group-IB (2019) · checked 2026-10-14
- SQLite — Write-Ahead Logging SQLite · checked 2026-10-14