What is actually inside a WhatsApp export

The file is not always called _chat.txt

This is the first trap, and it wastes everybody’s time. _chat.txt is the iOS name. An export made from Android is named after the thread, for example WhatsApp Chat with <name>.txt.

The practical consequence: a tool looking for _chat.txt inside the archive finds nothing on half the phones out there. Across the nine exports in the RevealChat calibration corpus, not one was called _chat.txt.

A more useful consequence: the thread name is in the file name. It is the only reliable source for who the conversation is with, and it often contains emoji, up to composed sequences like the family one.

The format of a line

On Android, each message opens with a line built exactly like this:

• DD/MM/YYYY, HH:MM - Author: content for a normal message.
• DD/MM/YYYY, HH:MM - service message for a notice with no author, such as a number change.
• Any line that does not start with a date belongs to the previous message.

On iOS the date is in brackets and carries seconds: [DD/MM/YYYY HH:MM:SS]. And an export in another language changes every marker at once, separator included. A tool that assumes a format instead of detecting it on the first few lines gets it wrong half the time.

Two details that look like nothing. The separator between author and text is : , and a message can contain one too: you must only split on the first occurrence. And an invisible character, U+200E, slips in at the start of the content. You cannot see it, and it breaks text comparisons.

Messages often span several lines

This is common, and it is the first thing amateur scripts get wrong: they count lines and believe they are counting messages. A message can contain line breaks, including blank lines in the middle of it. The only landmark is the date at the start of a line.

Across the nine exports in the corpus, that rule is enough: zero orphan lines across 196,830 messages. The format is regular, as long as you read it the right way.

The markers in angle brackets

WhatsApp replaces whatever it cannot put into text with a marker. Here is the real inventory taken from eight archives, with counts:

Two of these markers appeared in English inside a French export. That is not a transcription mistake: somebody who changes their phone language partway through leaves both sets in the same file.

⚠️ The trap not to fall into: a pattern like <[^>]+> to catch "anything in angle brackets" destroys real content. The same survey turned up <br>, <stdio.h> and <dependency>, written by somebody pasting code into the conversation. The marker list is a closed list, never a generic pattern.

The participants, where it really breaks

The text reads fine. It is identifying people that causes the real problems, and all of them show up in a corpus of nine conversations.

• The same person appears under two identities. One export contains a "changed their phone number" notice: the thread switches from the raw number to the address book name. Without merging them, that person is counted twice, and every balance calculation is wrong.
• A participant can be nothing but a number, because they are not in the address book. In one work thread with 54 participants, that was true of all of them.
• Display names contain emoji. They are neither identifiers nor first names.
• Some participants are almost absent: one group member with 1 message out of 14,653. Any ranking needs a participation floor, otherwise the podium is filled with noise.

And "me" appears nowhere in the file. It is worked out by subtraction, from the thread name, which works for a pair and fails for a group.

What you can get out of it, and what you cannot

The file gives you, unambiguously: who wrote, when to the minute, how many times, in what order, with which words, and when a media message was sent. That is already more than enough to count who carries the conversation.

It does not give you: deleted messages, the content of media, messages read but not replied to, calls beyond a notice, or anything at all about what happened outside WhatsApp. An analysis claiming to know why somebody did not reply is making it up: the file only says that they did not, and from when.

Media accounts for 27% of the corpus. Ignoring it means losing a quarter of the turns: a <Media omitted> carries no text, but it is a real message, and it counts for rhythm and balance.