Hi,
Just checking if anyone has tried any GREP carving for facebook chat?
I have used IEF and I'm looking into verification of the results for the chat.
Previously I have used this, "msg'{"text", but this yielded no results.
I am wondering if anyone else has had results with other expressions?
Gracias
From my experience the Facebook Chat is not stored on the local computer, it is only stored on the Facebook server. I have tried several different means to recover Facebook Chats but have been told that they are only on the server.
The facebook chat remains in RAM(not in web browser cashe) and because computers nowadays have large RAM capacity, almost nothing falls in pagefile.sys
The preceding posts may explain why you aren't getting any results but I have found a more refined expression to be"snippet"" Including the quote marks.
You can test this by having a conversation and capturing the memory whilst doing so. This of course is only to confirm that the expression works. I too have found that on modern machines any fragments of conversation on-disk are extremely rare.