Comments on: Viber SQlite Database Extraction / Forensics

By: admin

admin — Thu, 06 Nov 2025 03:01:43 +0000

In reply to interiorni vrati. Thanks for the update. It would probably make sense to encrypt the database, so can't really blame the company for doing that. I guess this post is now just a historical sidenote.

By: interiorni vrati

interiorni vrati — Fri, 10 Oct 2025 10:02:46 +0000

Unfortunately, viber.db encrypted in 2025 🙁 i tried many methods but no luck!

By: Cara

Cara — Sun, 12 Apr 2020 22:54:06 +0000

I came across this and really need some help. You would probably come the closest to someone who would understand. I have an iPhone 6 (I realize it's different, but) and due to my own fault, my storage got really full and overloaded the phone. It corrupted the photos app (iphone's own photos app that contains camera roll) somehow and I couldn't even open the app- it would just be a blank screen and crash. However, all the pictures remain and take up the same storage (100 gb). Yesterday, my Viber app glitched too and suddenly I couldn't scroll back up to my old messages like I could before- it just stopped at a very recent date. Tragically this happened but the app data still takes up the same amount of storage (400 mb) so I'm hoping somehow, I can do something to repair the Viber cache/database/sqlite/file/whatever it is, reboot it, and the app will magically repopulate all the messages. Problem is I can't back up my phone to itunes or any program before I start on a solution. Because of the glitches/corruption, I can't even do that. Would you know any solution? Or know anyone who could?? I would be willing to pay.

By: Adam

Adam — Fri, 10 Jan 2020 13:33:47 +0000

I used this to filter by sender

SELECT strftime('%Y-%m-%d %H:%M:%S',(Events.TimeStamp/1000),'unixepoch') AS Time,
Contact.Name AS Name,
Contact.ClientName AS AltName,
Contact.Number As Cellphone,
CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,
Messages.Body AS Message
FROM Events
INNER JOIN Contact ON Events.ContactID = Contact.ContactID
INNER JOIN Messages ON Events.EventID = Messages.EventID
WHERE Name = 'personsname'
ORDER BY Time;

How do I query for msgs between 2 contacts please?

Thanks in advance

By: John H

John H — Wed, 27 Nov 2019 01:51:49 +0000

Sorry to be such a pest. Thankyou in advance for your patience. I am a novice….. 🙂
I understand that if I can extract the whole database into .csv / excel I can find the text I want. My problem is I cannot get that to work. The original SQL extracts the data within SQLite easily. I need that to extract to .csv

I tried to run by itself the SQL:
sqlite3 -header -csv -separator '|' viber.db output.csv
but get syntax error
I then tried to put the SQL:
sqlite3 -header -csv -separator '|' viber.db output.csv
in to the original SQL you provided: (tried several places, but get syntax error)
SELECT strftime('%Y-%m-%d %H:%M:%S',(Events.TimeStamp/1000),'unixepoch') AS Time,
Contact.Name AS Name,
Contact.ClientName AS AltName,
Contact.Number As Cellphone,
CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,
Messages.Body AS Message
FROM Events
INNER JOIN Contact ON Events.ContactID = Contact.ContactID
INNER JOIN Messages ON Events.EventID = Messages.EventID
ORDER BY Time;

By: admin

admin — Mon, 25 Nov 2019 08:52:00 +0000

In reply to John H.

OK, so you're using the commandline sqlite command, like this, where viber.sql contains the query?
sqlite3 -header -csv -separator '|' viber.db < viber.sql > output.csv

… and it outputs a csv file?
… and you just want to search it for some text?

I don't see your problem in importing it into Excel. This guide should be fairly good. https://www.copytrans.net/support/how-to-open-a-csv-file-in-excel/
At stage 5, just put | in the Other box.

If that still isn't working, its just a text file. You could open it in a text editor, or even in Word and just use the Find button to look for text.

By: John H

John H — Sun, 24 Nov 2019 22:57:56 +0000

I really thankyou for your time.
Oh Dear, I am using SQL Lite, I tried as you said in last suggestion, but it doesn't output anything, whereas the original works fine to extract data, just need to either be able to export to SQL or find a specific part of a message
SELECT strftime('%Y-%m-%d %H:%M:%S',(Events.TimeStamp/1000),'unixepoch') AS Time,
Contact.Name AS Name,
Contact.ClientName AS AltName,
Contact.Number As Cellphone,
CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,
Messages.Body AS Message
FROM Events
INNER JOIN Contact ON Events.ContactID = Contact.ContactID
INNER JOIN Messages ON Events.EventID = Messages.EventID
ORDER BY Time;

Appreciate the help

By: admin

admin — Sat, 23 Nov 2019 05:27:51 +0000

John H. Sorry for the confusion. The "-csv-separator '|'" was referring to the command-line method of extracting the data. But if you're using the DBeaver method that won't be relevant. It's a long time since I wrote the original post, so I'd forgotten that I was giving you two ways to get the data.

If you've used the DBeaver method to load the data, you can actually search in there. Its a database after all! Something like this

Or, from DBeaver, export the results to CSV, and I think you should be able to specify a delimiter such as | (which is an uncommon character unlikely to be used in messages).

Or, there's even an extension to DBeaver which will let you export to Excel, I find. https://github.com/dbeaver/dbeaver/wiki/Extension-Office

Is any of that helping, or am I just making it more confusing?

By: John H

John H — Sat, 23 Nov 2019 03:15:22 +0000

Umm I tried, no result, not sure where to put the -csv -separator '|' I assume I have to somehow in SQL say mode .csv not sure what the commands are I put them before the select but can't seem to get it right

By: John H

John H — Sat, 23 Nov 2019 02:57:21 +0000

Thankyou for responding.I will try the .csv, and of course you are right finding a string in Excel is easier to do. I cannot thank you enough
Regards
John