{"id":402,"date":"2017-06-09T14:13:15","date_gmt":"2017-06-09T06:13:15","guid":{"rendered":"https:\/\/play.datalude.com\/blog\/?p=402"},"modified":"2019-07-21T13:21:37","modified_gmt":"2019-07-21T05:21:37","slug":"viber-sqlite-database-extraction-forensics","status":"publish","type":"post","link":"https:\/\/play.datalude.com\/blog\/2017\/06\/viber-sqlite-database-extraction-forensics\/","title":{"rendered":"Viber SQlite Database Extraction \/ Forensics"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Well you can use this to pull messages out of a Viber Desktop database. I personally had to do it when I re-installed Viber and it deleted my entire message history, which wasn't so friendly, so I pulled this out of the database so I could refer to it in a spreadsheet. Maybe there is a way of pumping it back into the new database &#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">I may end up putting more queries here when I discover them but below you'll find the basic one to dump out a summary of messaging. It converts the Unix timestamp dates into readable ones, and tells you which way the messsage went too. If you have any other such queries, let me know, and I'll include them: there didn't seem to be much on this around the internet.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">How you run the query is up to you. I previously used an SQlite extension for Firefox, but recently found the <a href=\"http:\/\/dbeaver.jkiss.org\/\">DBeaver<\/a> cross platform Database app, and its working a treat across sqlite, mysql, postgresql, so that's my favourite right now. Just run the query and export to CSV, using a strange delimiter such as '|' so the message isn't split into many fields at each comma.<br>\nYou could also run the query from the commandline: copy the command to a file, say viber.sql, and then use the following, suitable for a backup script perhaps.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">sqlite3 -header -csv -separator '|' viber.db &lt; viber.sql &gt; output.csv<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">On a standard install on Linux you'll find the viber.db under ~\/.ViberPC\/&lt;phonenumber&gt;\/viber.db<br>\nObviously make a copy first if you're nervous. Here is the query:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT strftime('%Y-%m-%d %H:%M:%S',Events.TimeStamp,'unixepoch') AS Time, \n Contact.Name AS Name,\n Contact.ClientName AS AltName,\n Contact.Number As Cellphone,\n CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,\n Messages.Body AS Message\nFROM Events \n INNER JOIN Contact ON Events.ContactID = Contact.ContactID\n INNER JOIN Messages ON Events.EventID = Messages.EventID\nORDER BY Time;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After a comment about the query no longer working, I discovered that Viber has changed the database format, and the Events.Timestamp field now contains thousandths of a second (although it doesn't seem to use them). So if the one above returns null values for Time, then try dividing it by 1000 like this. <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>SELECT strftime('%Y-%m-%d %H:%M:%S',(Events.TimeStamp\/1000),'unixepoch') AS Time, \n Contact.Name AS Name,\n Contact.ClientName AS AltName,\n Contact.Number As Cellphone,\n CASE Direction WHEN 0 THEN 'rcvd' ELSE 'sent' END AS Direction,\n Messages.Body AS Message\nFROM Events \n INNER JOIN Contact ON Events.ContactID = Contact.ContactID\n INNER JOIN Messages ON Events.EventID = Messages.EventID\nORDER BY Time;<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you have the same query for other versions of Viber and they're different, let me know.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Well you can use this to pull messages out of a Viber Desktop database. I personally had to do it when I re-installed Viber and it deleted my entire message history, which wasn't so friendly, so I pulled this out of the database so I could refer to it in a spreadsheet. Maybe there is &#8230; <a title=\"Viber SQlite Database Extraction \/ Forensics\" class=\"read-more\" href=\"https:\/\/play.datalude.com\/blog\/2017\/06\/viber-sqlite-database-extraction-forensics\/\" aria-label=\"Read more about Viber SQlite Database Extraction \/ Forensics\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[1,4],"tags":[],"class_list":["post-402","post","type-post","status-publish","format-standard","hentry","category-it","category-linux"],"_links":{"self":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts\/402","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/comments?post=402"}],"version-history":[{"count":0,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/posts\/402\/revisions"}],"wp:attachment":[{"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/media?parent=402"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/categories?post=402"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/play.datalude.com\/blog\/wp-json\/wp\/v2\/tags?post=402"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}