Accessing files without GUI

[cerealbuilder]

Is there any way to access the files parsed without using the GUI through a CLI or otherwise?

[MaxiHuHe04]

@cerealbuilder This application doesn't have a CLI currently. I developed it in a relatively modular way, so it wouldn't be that much work, but I haven't seen much demand for this yet.
There are a few CLI-only projects, although the last time I checked was a long time ago and I don't remember any nice one that supports encrypted backups, so I can't recommend anything specific.
Apart from CLI, there would be the possibility to use my project as a library if you are familiar with Java and want to script something specific.
What you could also do already is locating the decrypted SQLite database in your temp folder after you open it in the application and take a look at it via DB browser or a sqlite library for Python or something.
In case this isn't what you were looking for at all, please explain your use-case in a bit more detail.

[cerealbuilder]

Yeah, you're exactly right. I am hoping to extend the CLI tool I'm using to also account for the encrypted backups. If I'm able to get the files already and have a system for previewing the files that are available, is there a piece of the library I can use to handle just the decryption?

[cerealbuilder]

Got it working! One question, WhatsApp seems to be encrypted still, do you know if there are other steps needed to access those files?

[MaxiHuHe04]

Alright, nice. Which files exactly are "still encrypted"? I don't know much about WhatsApp data in the backups, but I would be surprised if there are files that are encrypted twice. Here you can find some information about the paths and contents: https://www.group-ib.com/blog/whatsapp-forensic-artifacts/#:~:text=databases/wa.db.-,WhatsApp%20artifacts%20in%20iOS%20devices,-Unlike%20Android%20OS.

[cerealbuilder]

Yeah, I dont think it's double encrypted. What happens in these cases:

1. Whatsapp is end to end encrypted via app, and as well as the backup, or 2) Whatsapp is end to end encrypted but backup is not

[cerealbuilder]

Really, it's just about the e2e encrypted settings in WhatsApp. I see some data in the backup, just not sure what to do with it to access the chat DB.

[MaxiHuHe04]

I also thought about the end to end settings, but I imagined that this would only apply to the backup it uploads to iCloud.
So does your backup really not have a ChatStorage.sqlite file in the WhatsApp shared AppDomainGroup?

[cerealbuilder]

It only produces a .sqlite.enc file that can’t be decrypted with the same process as the rest of the backup.

[MaxiHuHe04]

Interesting. I've read that the database is encrypted by WhatsApp on non-encrypted backups, but not additionally encrypted by WhatsApp on encrypted iTunes backups. Maybe this changes with the end to end setting.
It may be possible to extract the keys for decrypting the ChatStorage.sqlite.enc file from the keychain in the backup, but I can't help you with that at the moment unfortunately.
I have tried decrypting the keychain at some point, but wasn't entirely successful. Then you would still need to find out how exactly the file is encrypted.