Somewhat related to my other Facebook post. In the timeline I am seeing filenames in the form of
p_[user number]=[num]
These come from 0.10.channel.facebook.com (some variation in the number, I'm sure).
The content that I have is pretty non-descript (for (;;);{"t""continue"} ).
My main question is, can anyone confirm that the [user number] portion of the file name is in fact the user number? I tried to recreate these files by browsing Facebook, but none were found afterward.
Any help would be appreciated.
In my experience, the p_(number) has been the naming convention used for cached facebook chat files. It appears that (number) is the profile id of the user the message is sent to. So if I send a message to Sally, (number) will be Sally's facebook id.
Thank you for the reply Flamerescue150.
These have much more utility than just that, I think. One I am looking at is for notifications. The rest have the content listed above.
To be clear, would these bear the receipent's ID on the Sender's system?
For example, John (ID number 34) sends a message to Sally (ID number 52). On John's system, would we then expect to find p_52=0? Or would we see p_34=0?
Any insight would be greatly appreciated.
Thank you for the reply Flamerescue150.
These have much more utility than just that, I think. One I am looking at is for notifications. The rest have the content listed above.
To be clear, would these bear the receipent's ID on the Sender's system?
For example, John (ID number 34) sends a message to Sally (ID number 52). On John's system, would we then expect to find p_52=0? Or would we see p_34=0?
Any insight would be greatly appreciated.
Unless there has been a recent change which I am not aware of the number after the p_ would be the account who is using the chat facility on the local computer. For your example the files on the local system would be named p_34. This would hold true even if John was logged in and was chatting to multiple recipients and would also hold true for messages which are sent and/or received
It appears that (number) is the profile id of the user the message is sent to. So if I send a message to Sally, (number) will be Sally's facebook id.
Have you obtained this information from a recent case? If so when?
This is very helpful as I am currently working on a case where IIOC is being searched for along with FB chat so the FB account logged into on the local machine to chat at that time is very relevant (HstEx recovered entries from 2010/11).
Can anyone enlighten me as to what the other numeric values and the true/false entry relate to?