CRYPT15 Files

What is a .CRYPT15 file?

A msgstore.db.crypt15 represents an encrypted Android WhatsApp local database backup whose common filename is typically the "msgstore.db.crypt15" found in either of the two databases folders - internal or SD-card backed up folders - on the Android smartphone. This .CRYPT15 backup format was created automatically as part of a private backup by the company WhatsApp, presently owned by Meta Platforms. Furthermore, WhatsApp LLC has yet not provided a public specification document of the .CRYPT15 format. The default content of such .CRYPT15 file includes conversation details (the chat messages and metadata), status data, plus the media file pointers.

The .CrypXX extensions are some of the WhatsApp extensions with .CRYPT5, .CRYPT7, .CRYPT8, .CRYPT10, .CRYPT12, .CRYPT14, and .CRYPT15 among them in order of the encryption generation and not of file versions that are usually seen and identified from a file explorer program as well as WhatsApp applications. A .CRYPT15 extension does not indicate a ZIP file (compressed/extracted or archived file), not a plaintext (.txt) nor a SQLite database format since the encryption hides this data format. In any event, there are no common non-Wasapp formats using .crypt15, wa.db.crypt15 or msgstore-YYYY-MM-DD.1.db.crypt15 for such .CRYPT15 family.

How to open a .CRYPT15 file

Technical details

.Crypt15 Files Description .Crypt15 file extension stands for a container of a binary, high-entropy kind of file, which means that it is not an ASCII or a plain-text file. Its principal contents consist of a SQLite database, protected with WhatsApp encryption within its own Android-specific backup protocol, where the usual SQLite file's header with signature "SQLite format 3" does not occur. Generally, it lacks reliable magic-byte sequence identification of its contents for .crypt15 file type, but the typical way to identify them is their filename, location on filesystem, high value of entropy, and possibility for reading by WhatsApp itself or decryption utility.

Before encryption, the SQLite database typically uses filename as follows "msgstore.db". Date backups' names are formed as "msgstore-date-number_of_sequence.1.db.crypt15", indicating the presence of a previous backup file with the local copy, made before current one. As the .CRYPT15 file contains encrypted database, any attempts to open it in text editors and/or SQLite browser would display garbled characters or report an error that "file is not a database".

After the .crypt15 file has been decrypted, its structure turns out to be just standard SQLite DB file with all appropriate tables for chats messages and their related metadata including chat timestamps, JID / phone-numbers fields, statuses, etc., as well as pointers/references to media attachments if they are saved outside database in WhatsApp/Media folder (images, audio/voice messages or videos and documents).

Standard .crypt15 file sizes vary from few M-bytes up-to several hundred of M-bytes depending on amount of data in account and how much messages have been accumulated throughout history. There is no official WhatsApp CRYPT15 format documentation; WhatsApp does not provide any technical details about encryption used or its guarantee. There is no MIME type specified to CRYPT15; the actual type should be application/octet-stream.

How to convert .CRYPT15 files

Decryption is the single meaningful operation possible with a .crypt15 extension on the WhatsApp msgstore. It will require using the proper WhatsApp keys for encryption, setting up an equivalent backup system on Android or going via other allowed restore method(s). Changing the file ending (.db, .sqlite or .zip) won't decrypt the message files since those aren't recognized by tools as databases "file is not a database". The popular solution is WhatsApp Crypt14/Crypt15 Decrypter (command examples below): - python3 decrypt.py msgstore.db.crypt15 msgstore.db - followed optionally with sqlitedump to make full dumps: sqlite3 msgstore.db .dump > msgstore.sqlCopy

CSV extraction works well for use with spreadsheet and other analytical software, but each file will generally contain one table or results for one query, e.g. - sqlite3 -header -csv msgstore.dbCopy "SELECT * FROM messages;" > messages.csv

The above will result in lack of any indexes and foreign relationships among the tables. For readable chat history export, it is best done in the HTML form (supported by many solutions like Elcomsoft Explorer for WhatsApp where all indexes, participant names, time of conversation etc. are kept in one file that can be browsed as usual webpage. PDF format makes it easily printable, while plain text can be outputted via WhatsApp app after a backup restoration.

Common problems and fixes

Some SQLite tools designed to extract data directly might give "File is not database" as an error message. It means practically that the file is wrapped correctly with .crypt15 wrapper, or is partially truncated, so you need to decrypt it first using WhatsApp key. To check that everything went correct with decryption just see if there's "SQLite format 3\0" on file beginning.

The backup setup itself might also tell about non-existing backup due to incorrect directory, incorrectly named file (msgstore naming), insufficient permission rights to Android device, wrong Google account/local account. There can also be a mismatch between Google account/phone which were used when creating the backup and the current Google/local accounts. It might be a case of backup failure due to mismatch between the phone number and the account which made this backup since WhatsApp requires the use of the same credentials to decrypt and restore backup.

Sometimes third party recovery tools can complain about version of the backup which is no longer supported in CRYPT15 internal structure changes. The update should be tried initially, if it doesn't help - copy and restore some earlier backup with compatible WhatsApp build.

If you see cloud or MTP transfer problems, or your Android file got partially read because you had little space left in the place where file copied, you'll see the file truncation issue since its length became less compared to file length on original phone where you've made the original copy of backup.

After restoring chats via WhatsApp recovery tool and seeing media content is missing, it usually tells us that msgstore.db.crypt15 is all we've copied to the recovery destination but we forgot to copy the WhatsApp/Media contents too and/or restore cloud backups where these media files included. On Windows OSes/macOSes the file is often registered in file index system incorrectly because it's marked specially encrypted file, and therefore should better not to try to run it from file manager using just double click, run WhatsApp instead.

If there're many dated msgstores, take latest good-looking version of file. Otherwise do renaming in proper WhatsApp way (according to restore documentation instructions).

Security considerations

.CRYPT15 file is actually encrypted WhatsApp backup of Android origin and is not an archive containing potentially executable content like a macro or script which would be initiated at the moment of extraction. Main risk comes during decryption procedure when sensitive information, namely WhatsApp database content can be retrieved: messages, contacts list, numbers, groups names and times, etc., plus export as HTML, PDF, or TXT files. In such case, no more WhatsApp protection is there so treat .db recovered files as well as SQLite dump files and all types of chat reports with the highest caution.

Use newest forensic tools in order to prevent potential issues caused by corrupted input binaries in old software versions (e.g. DB Browser for SQLite or external decrypting tools); never post your own .crypt15 file or key file via some web pages; decryption procedure involves secrets so a single uploaded file reveals all your messages. Also remember that erasing of the .CRYPT15 file will not eliminate cloud duplicates or previous versions of file exported in other forms.

History and versions

The file naming format with numbers, such as .crypt extension in WhatsApp LLC has been used for backup files of Android database for a long time. Older versions included the following - .crypt5, .crypt7, .crypt8, .crypt10 and .crypt12 before CRYPT14 and CRYPT15 got popular in recent WhatsApp Android backups. Crypt15 started becoming popular from 2021 along with the developments and changes made by WhatsApp to backup encrypting and key management on Android applications. This file extension comes out of automatically created files for both Android WhatsApp Messenger app, and WhatsApp Business app for Android. There is no particular editor available to create it for the user. It is a nonstandard file extension without any IETF/ ISO or ECMA standard or other standards association guidelines published. The importance of this file type currently still exists, considering that many Android users get files such as msgstore.db.crypt15 while restoring and recovering their Android device data.

Related formats

.CRYPT14 is the direct prior in terms of WhatsApp’s series of encrypted backups. Devices that support decrypting .crypt15 files can handle decrypting .CRYPT14 also, though these correspond to different generation of encryption. The oldest one, .CRYPT12 file, which has good description on decrypting from the community manuals, isn’t compatible with .crypt15 files despite their shared msgstore.db structure. A decryption produces regular DB backup (a regular SQLite database), which can then be opened with the DB browser for SQLite, sqlite3 or similar SQL programs, but loses the encryption wrapper of WhatsApp. SQLITE and SQLITE3 are the generic SQLite extensions. The file of .crypt15 backup type includes an encrypted WhatsApp-specific SQLite archive wrapped into it. “BAK” is an all-purpose backup extension while “AB”, and Android-based application databases in general do not correspond to the structure of a WhatsApp chat backup. ZIP is the name for an easily viewable archive. .crypt15 is not a ZIP archive. The conversions to the readable types like TXT, HTML, PDF and so on are the lossy exports of an original backup file.