Dig out deleted cha...
 
Notifications
Clear all

Dig out deleted chat messages of App Skype

12 Posts
3 Users
0 Reactions
835 Views
(@gorvq7222)
Reputable Member
Joined: 11 years ago
Posts: 236
Topic starter  

Last month Candy was arrested on suspicion of having doing online porn webcam shows, but Candy refused to confess to her crime. The Police extracted data from her iPhone and found lots of chat messages in Skype’s database – main.db.

Unfortunately there was no clear evidence in main.db. But forensic guys did not give up easily. Another senior examiner found some interesting chat messages in Skype “chatsync” folder. You guys could take a look at my blog to see the screenshots
http//www.cnblogs.com/pieces0310/p/5816027.html

According to the chat messages Candy sent, we could see that she gave a link to her client and invited him to create a profile.

The examiner visited at that link and found a porn website about online porn webcam shows.

The Police showed Candy what they have found in her phone. Candy was shocked and admitted her guilty. Candy was wondering why the Police could dig out those chat messages being deleted several months ago.

The truth is that those deleted chat messages still could be found in files inside Skype chatsync folders.


   
Quote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Last month Candy was arrested on suspicion of having doing online porn webcam shows.

Out of curiosity, which kind of crime is that (and in which Country is it a crime?)?

jaclaz


   
ReplyQuote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

Here is an overview software which can do it. wink

Extracting Evidence from Destroyed Skype Logs and Cleared SQLite Databases

https://articles.forensicfocus.com/2013/11/26/extracting-evidence-from-destroyed-skype-logs-and-cleared-sqlite-databases/


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Here is an overview software which can do it. wink

Extracting Evidence from Destroyed Skype Logs and Cleared SQLite Databases

https://articles.forensicfocus.com/2013/11/26/extracting-evidence-from-destroyed-skype-logs-and-cleared-sqlite-databases/

Well to be fair, in this particular case seemingly just carving *.dat for "http//" would have produced the same result ….

…and BTW the bit.ly link viewable on the screenshots of the hex view is still active and still leading to some sort of (presumably) p0rn webcam site …

jaclaz


   
ReplyQuote
Igor_Michailov
(@igor_michailov)
Honorable Member
Joined: 20 years ago
Posts: 529
 

…and BTW the bit.ly link viewable on the screenshots of the hex view is still active and still leading to some sort of (presumably) p0rn webcam site …

jaclaz

The article does not contain any screenshots.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

The article does not contain any screenshots.

Not your article, of course, the one linked to by the OP, about the p0rn webcam criminal "Candy".

jaclaz


   
ReplyQuote
(@gorvq7222)
Reputable Member
Joined: 11 years ago
Posts: 236
Topic starter  

Hi Jaclaz,
As I know the crime which she was charged was "indecent exposure".


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Hi Jaclaz,
As I know the crime which she was charged was "indecent exposure".

Hmmm. ?
And what country is that? 😯
I mean "indecent exposure" is generally intended as "public exposure", someone inviting someone else (through a login/access site on the internet) to a peep-show is hardly "public".

jaclaz


   
ReplyQuote
(@gorvq7222)
Reputable Member
Joined: 11 years ago
Posts: 236
Topic starter  

Sorry I'm not familiar with law or regulation. What forensic guys need to do is to extract data and find out what's going on. No comment for specific cases.


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

Sorry I'm not familiar with law or regulation. What forensic guys need to do is to extract data and find out what's going on. No comment for specific cases.

You don't need to be familiar with Law, nor to provide a comment, you posted a story, I asked you WHERE it did happen, and not asking for particular location, just the country or state where it did happen (if it actually happened), as it sounds to me extraordinary (very unusual) that the Police (or the "forensic guys" or both) had the time and will to do a forensic analysis of a phone [*]for a crime that seems like not being particularly serious (and actually AFAIK isn't a crime at all in many countries, assuming that "Candy" and her "client" are both adults).

Of course you are perfectly free ) to keep that piece of info reserved, no problem.

jaclaz

[*]actually since "common" forensic investigator were not able to find anything, a second exam by a senior examiner was needed


   
ReplyQuote
Page 1 / 2
Share: