{"action":"created","issue":{"url":"https://api.github.com/repos/B16f00t/whapa/issues/3","repository_url":"https://api.github.com/repos/B16f00t/whapa","labels_url":"https://api.github.com/repos/B16f00t/whapa/issues/3/labels{/name}","comments_url":"https://api.github.com/repos/B16f00t/whapa/issues/3/comments","events_url":"https://api.github.com/repos/B16f00t/whapa/issues/3/events","html_url":"https://github.com/B16f00t/whapa/issues/3","id":328687089,"node_id":"MDU6SXNzdWUzMjg2ODcwODk=","number":3,"title":"Google Drive: previous backups not visible","user":{"login":"kaefert","id":1448723,"node_id":"MDQ6VXNlcjE0NDg3MjM=","avatar_url":"https://avatars1.githubusercontent.com/u/1448723?v=4","gravatar_id":"","url":"https://api.github.com/users/kaefert","html_url":"https://github.com/kaefert","followers_url":"https://api.github.com/users/kaefert/followers","following_url":"https://api.github.com/users/kaefert/following{/other_user}","gists_url":"https://api.github.com/users/kaefert/gists{/gist_id}","starred_url":"https://api.github.com/users/kaefert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaefert/subscriptions","organizations_url":"https://api.github.com/users/kaefert/orgs","repos_url":"https://api.github.com/users/kaefert/repos","events_url":"https://api.github.com/users/kaefert/events{/privacy}","received_events_url":"https://api.github.com/users/kaefert/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":11,"created_at":"2018-06-01T23:17:35Z","updated_at":"2018-06-10T13:06:55Z","closed_at":null,"author_association":"NONE","body":"Hi there!\r\n\r\nSadly my girlfriend managed to overwrite her 1GB big WhatsApp backup of a few years in her Google Drive Account with a new backup of the last few days. It seems that Android Oreo causes the WhatsApp Backup Restore function too malfunction badly, only allowing users (that don't read the screen too much before clicking buttons...) to setup a new backup into Google Drive without restoring the old one.\r\n\r\nNow her Google Drive Account still shows \"Hidden app data: 1 GB\" under https://drive.google.com -> Settings -> Manage Apps -> WhatsApp Messenger\r\nSo I had hoped that the data still is stored somewhere, which is why I tried to get your whagodri.py script running, but sadly, I can only see the tiny new backup:\r\n\r\n```\r\nkaefert@mint ~/Downloads/android/whapa $ python2 whagodri.py -l\r\n\r\n     __      __.__             ________      ________        .__ \r\n    /  \\    /  \\  |__ _____   /  _____/  ____\\______ \\_______|__|\r\n    \\   \\/\\/   /  |  \\\\__  \\ /   \\  ___ /  _ \\|    |  \\_  __ \\  |\r\n     \\        /|   Y  \\/ __ \\\\    \\_\\  (  <_> )    `   \\  | \\/  |\r\n      \\__/\\  / |___|  (____  /\\______  /\\____/_______  /__|  |__|\r\n           \\/       \\/     \\/        \\/              \\/          \r\n\r\n    ------------ Whatsapp Google Drive Extractor v0.1 ------------\r\n    \r\n[i] Searching...\r\n\r\n[+] Backup ID: 0\r\n    [+] Number: 1 / 0\r\n        [-] File    : Databases/msgstore.db.crypt12\r\n        [-] Hash MD5: 0eef660a7cb43cc32e41343b81da63e2\r\n        [-] Request : 1Bi4CGXZfTq1xSmA6IEjuCYpdKghy3_4Rm1oTpbfATg4LSMREGQ\r\n        [-] Size    : 52793 Bytes (51.56 KB)\r\n\r\n    [+] Number: 2 / 0\r\n        [-] File    : Media/WhatsApp Images/IMG-20180531-WA0000.jpg\r\n        [-] Hash MD5: 5bc0c4d2ca9b8357deb4d3a1703fc550\r\n        [-] Request : 1HBvc9oBJAhSoYnMhVzxGv-Kqpwe3A3hrlw4\r\n        [-] Size    : 105391 Bytes (102.92 KB)\r\n```\r\n\r\nCan you help me? Do you know of any way that might enable me to find the overwritten backup in there?"},"comment":{"url":"https://api.github.com/repos/B16f00t/whapa/issues/comments/396047878","html_url":"https://github.com/B16f00t/whapa/issues/3#issuecomment-396047878","issue_url":"https://api.github.com/repos/B16f00t/whapa/issues/3","id":396047878,"node_id":"MDEyOklzc3VlQ29tbWVudDM5NjA0Nzg3OA==","user":{"login":"kaefert","id":1448723,"node_id":"MDQ6VXNlcjE0NDg3MjM=","avatar_url":"https://avatars1.githubusercontent.com/u/1448723?v=4","gravatar_id":"","url":"https://api.github.com/users/kaefert","html_url":"https://github.com/kaefert","followers_url":"https://api.github.com/users/kaefert/followers","following_url":"https://api.github.com/users/kaefert/following{/other_user}","gists_url":"https://api.github.com/users/kaefert/gists{/gist_id}","starred_url":"https://api.github.com/users/kaefert/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kaefert/subscriptions","organizations_url":"https://api.github.com/users/kaefert/orgs","repos_url":"https://api.github.com/users/kaefert/repos","events_url":"https://api.github.com/users/kaefert/events{/privacy}","received_events_url":"https://api.github.com/users/kaefert/received_events","type":"User","site_admin":false},"created_at":"2018-06-10T13:06:55Z","updated_at":"2018-06-10T13:06:55Z","author_association":"NONE","body":"Okey, so:\r\n* Google Drive support says they can't access the data.\r\n* WhatsApp support says \"There isn't a way to restore a previous Google Drive Backup.\".\r\n\r\nI think it was just one single \"bad\" backup that has been written to Google Drive @ 2018-06-01 02:26 (probably WhatsApp displays this time in my local time zone, that would be CEST).\r\n\r\nI've disabled the automatic Google Drive backup check in WhatsApp on that phone in the evening of 2018-06-01, so no new backups have been written to Google Drive since then. (I instead setup an auto-upload to my Nextcloud to backup the new data, which has includes a feature to get back previous versions should problems like these ever arise again in the future..)\r\n\r\nThe last \"good\" backup should have been written to Google Drive @ 2018-05-30 ~02:30 CEST, or maybe one day before. On 2018-05-31 ~02:00 the phone was already reinstalled with a new OS but WhatsApp hadn't been installed yet.\r\n\r\nThe Google Drive Account still shows \"Hidden app data: 1 GB\" under https://drive.google.com -> Settings -> Manage Apps -> WhatsApp Messenger. Since this data has been \"overwritten\" more than 9 days ago, I do not believe that it has truly been deleted, but still at least partly exists in that Google Drive storage account somewhere. (Since the one new \"bad\" backup made has a size of just 150kb.)\r\n\r\nThe big question now is how to get access to that data. Can you help?"}}
{"actor":{"display_login":"kaefert"}}