Viber SQlite Database Extraction / Forensics

Well you can use this to pull messages out of a Viber Desktop database. I personally had to do it when I re-installed Viber and it deleted my entire message history, which wasn’t so friendly, so I pulled this out of the database so I could refer to it in a spreadsheet. Maybe there is a way of pumping it back into the new database …

I may end up putting more queries here when I discover them but below you’ll find the basic one to dump out a summary of messaging. It converts the Unix timestamp dates into readable ones, and tells you which way the messsage went too. If you have any other such queries, let me know, and I’ll include them: there didn’t seem to be much on this around the internet.

How you run the query is up to you. I previously used an SQlite extension for Firefox, but recently found the DBeaver cross platform Database app, and its working a treat across sqlite, mysql, postgresql, so that’s my favourite right now. Just run the query and export to CSV, using a strange delimiter such as ‘|’ so the message isn’t split into many fields at each comma.
You could also run the query from the commandline: copy the command to a file, say viber.sql, and then use the following, suitable for a backup script perhaps.

sqlite3 -header -csv -separator '|' viber.db < viber.sql > output.csv

On a standard install on Linux you’ll find the viber.db under ~/.ViberPC//viber.db
Obviously make a copy first if you’re nervous. Here is the query:

SELECT strftime('%Y-%m-%d %H:%M:%S',Events."TimeStamp",'unixepoch') AS Time, 
 Contact.Name AS Name,
 Contact.ClientName AS AltName,
 Contact.Number As Cellphone,
 CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,
 Messages.Body AS Message
FROM Events 
 INNER JOIN Contact ON Events.ContactID = Contact.ContactID
 INNER JOIN Messages ON Events.EventID = Messages.EventID

If you have the same query for other versions of Viber and they’re different, let me know.

4 thoughts on “Viber SQlite Database Extraction / Forensics”

  1. Sorry for the late reply. I’m not used to getting comments here that aren’t spam!
    With Dbeaver, first you have to set up a connection. For Sqlite, that’s basically pointing it at the file you want to open. I’d recommend copying the database to another file, so you don’t mess up the original.
    You’d also have to make sure the dbeaver sqlite driver extension is installed. And you may have to install support in your OS too. For debian/ubuntu that would be “apt install sqlite3”

  2. I think the database contains some extra information that ties it to your current installation. I did try copying the db, but it didn’t work.
    Possibly the way to do this would be to insert the old messages into the new database. But that looked like a lot of work. In the end I just settled for a historic, archival record of the messages.

Leave a Comment