Facebook chat carvi...
 
Notifications
Clear all

Facebook chat carving...

4 Posts
4 Users
0 Likes
379 Views
Novunix
(@novunix)
Posts: 35
Eminent Member
Topic starter
 

Hi,

Just checking if anyone has tried any GREP carving for facebook chat?

I have used IEF and I'm looking into verification of the results for the chat.

Previously I have used this, "msg'{"text", but this yielded no results.

I am wondering if anyone else has had results with other expressions?

Gracias

 
Posted : 09/10/2015 12:19 pm
(@frostyx4)
Posts: 11
Active Member
 

From my experience the Facebook Chat is not stored on the local computer, it is only stored on the Facebook server. I have tried several different means to recover Facebook Chats but have been told that they are only on the server.

 
Posted : 10/10/2015 6:44 am
(@kastriot)
Posts: 5
Active Member
 

The facebook chat remains in RAM(not in web browser cashe) and because computers nowadays have large RAM capacity, almost nothing falls in pagefile.sys

 
Posted : 10/10/2015 3:52 pm
binarybod
(@binarybod)
Posts: 272
Reputable Member
 

The preceding posts may explain why you aren't getting any results but I have found a more refined expression to be
"snippet"" Including the quote marks.
You can test this by having a conversation and capturing the memory whilst doing so. This of course is only to confirm that the expression works. I too have found that on modern machines any fragments of conversation on-disk are extremely rare.

 
Posted : 13/10/2015 11:55 pm
Share: