Apple - What happens when WhatsApp from an old phone is connected again?

  1. If you have a Mac, you can navigate to the following folder using terminal:

    ~/Library/Mobile Documents/
    
  2. List all hidden files (from the terminal) to see a folder which looks like: 12HJ1123DHJ~net~whatsapp~WhatsApp, i.e. random alpha-numeric sequence ending with net~whatsapp~WhatsApp. cd into this folder.

  3. Next, navigate into Accounts/<PhoneNumber>/backup from this folder.

Finally you'll be in a folder whose path which looks like this (check with pwd):

~/Library/Mobile Documents/12HJ1123DHJ~net~whatsapp~WhatsApp/Accounts/<PhoneNumber>/backup

Your chat backup and history is stored in this folder. (Hidden files, can be seen with ls -al)

[email protected]  1 pse  staff  177 Jun  2 17:20 .BackedUpKeyValue.sqlite.enc.icloud
[email protected]  1 pse  staff  159 Jun  2 17:21 .Backup.plist.icloud
[email protected]  1 pse  staff  174 Jun  2 17:20 .ChatStorage.sqlite.enc.icloud
[email protected]  1 pse  staff  165 Jun  2 17:20 .Document.tar.aux.icloud
[email protected]  1 pse  staff  162 Jun  2 17:20 .Document.tar.icloud
[email protected]  1 pse  staff  158 Jun  2 17:21 .GIFs.tar.icloud
[email protected]  1 pse  staff  161 Jun  2 17:21 .Media.tar.aux.icloud
[email protected]  1 pse  staff  159 Jun  2 17:21 .Media.tar.icloud
[email protected]  1 pse  staff  161 Jun  2 17:20 .Media_1.tar.icloud
[email protected]  1 pse  staff  168 Jun  2 17:20 .Ranking.sqlite.enc.icloud
[email protected]  1 pse  staff  168 Jun  2 17:20 .Sticker.sqlite.enc.icloud
[email protected]  1 pse  staff  162 Jun  2 17:21 .Stickers.tar.icloud
[email protected]  1 pse  staff  167 Jun  2 17:21 .Thumbnail.tar.aux.icloud
[email protected]  1 pse  staff  163 Jun  2 17:21 .Thumbnail.tar.icloud
[email protected]  1 pse  staff  167 Jun  2 17:21 .Thumbnail_1.tar.icloud
[email protected]  1 pse  staff  172 Jun  2 17:20 .UserDefaults.plist.enc.icloud
[email protected]  1 pse  staff  161 Jun  2 17:20 .calls.log.enc.icloud
[email protected]  1 pse  staff  177 Jun  2 17:20 .current_wallpaper.jpg.enc.icloud

You can make a copy of this folder (cp -r)

Technically these are just Apple binary property lists:

$ plutil -p .calls.log.enc.icloud 
{
  "NSURLFileResourceTypeKey" => "NSURLFileResourceTypeRegular"
  "NSURLFileSizeKey" => 1411
  "NSURLNameKey" => "calls.log.enc"
}

The quest to find the actual data still goes on :-)