\WhatsApp\Service Worker\CacheStorage you find unencrypted multimedia files. You have to skip a header and a fake url, which usually finishes in
%3D. The rest is a multimedia file. Easiest to recognize are jpg headers, but I also found png, riff, ogg, mp4.
If you have only a few files in Cache and ServiceCache you can find pairs of files with almost matching size (comparing the encrypted
f_* files with the header stripped
*_0 files, assuming that the
f_ is the encrypted version of the
_0 file. The
f_ files are larger, filled up to the next multiple of 16, plus 10 extra bytes. So one guess was that the original file was padded with 0's up to the next multiple of 16, encrypted, and an iv of size 10 bytes (!) was stored with the file. Or of size 8 and two other bytes.
I have my key to decrypt
msgstore.db.crypt12 files (which is pretty useless, because when you have the key you also have the unencrypted
msgstore.db). However I didn't succeed.