±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36296
New Yesterday: 2 Visitors: 159

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

File Type Help? Recovering Deleted FB Messages

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

aolney
Newbie
 

File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 06, 19 01:31

Hi,


Hopefully this fits in this section. I am in the middle of attempting to recover deleted Facebook Messages, but am now stuck.
I am unsure of what types of files these are and how to open or use them?

Any help is appreciated.

 
 
  

armresl
Senior Member
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 06, 19 04:29

Hi,

Some context on what we are looking at would help.
That is a screenshot of what?
How did you get the data, what are you looking at it with, etc, etc.

- aolney
Hi,


Hopefully this fits in this section. I am in the middle of attempting to recover deleted Facebook Messages, but am now stuck.
I am unsure of what types of files these are and how to open or use them?

Any help is appreciated.


_________________
Why order a taco when you can ask it politely?

Alan B. "A man can live a good life, be honorable, give to charity, but in the end, the number of people who come to his funeral is generally dependent on the weather. " 
 
  

aolney
Newbie
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 06, 19 04:44

- armresl
Hi,

Some context on what we are looking at would help.
That is a screenshot of what?
How did you get the data, what are you looking at it with, etc, etc.


This is a screen shot of the documents folder
It was pulled using Phone Rescue and these are the files inside the messenger app folder.
It looks like all the files are named after Unix Timestamps.  
 
  

gungora
Member
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 08, 19 00:54

I am not familiar with Phone Rescue but a good starting point might be to identify the file types you have from their binary signatures. You could use a forensic suite such as X-Ways, or something along the lines of TrID for this.

Once you have the file type predictions, you might want to start by exploring database types (e.g., SQLite) if any.

Is 6/28/2016 the date when this data set was exported?

- aolney

This is a screen shot of the documents folder
It was pulled using Phone Rescue and these are the files inside the messenger app folder.
It looks like all the files are named after Unix Timestamps.

_________________
Arman Gungor

Metaspike
Developers of Forensic Email Collector
www.metaspike.com 
 
  

aolney
Newbie
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 09, 19 13:08

5/11/2016 is the date the files were exported. I am curious to where you got 6/28/16 from. Thanks for your help so far!  
 
  

aolney
Newbie
 

Re: File Type Help? Recovering Deleted FB Messages

Post Posted: Jan 09, 19 17:51

Sorry just realized that the date modified says 6/28/16  
 

Page 1 of 1