I totally agree with you.
The main stream software concentrates on the actual databases where for want of a better term the data sits re messaging.
They do not look at all databases relating to an application.
Hence a good rummage through all databases is very worthwhile.
PS each message in the "docs_content" Table has a "docid" associated to it. This id in the "metadata" table has a date / time value (seconds from 2001)
Also it looks like the "c1Chatsession" column relates to the chat the message is associated too.
If a group chat the first part is the id of the chat creator. ie 44111111111-1012345678@g.us
Ie the 4411111111 is the creator of the group chat
I think the 1012345678 is a unique ID
together they make up the chat ID
Therefore with out the original chat it is difficult to say who sent the message(re data in the chat chatsearch db)
an ID of 4411111111@s.whatsapp.net is purely a chat with only two individuals. ie the handset being examined and the "other party".
The id should be the telephone number of the "other party"
↧