Join Us!

File Type Help? Rec...
 
Notifications
Clear all

File Type Help? Recovering Deleted FB Messages  

  RSS
aolney
(@aolney)
New Member

Hi,

Hopefully this fits in this section. I am in the middle of attempting to recover deleted Facebook Messages, but am now stuck.
I am unsure of what types of files these are and how to open or use them?

Any help is appreciated.

Quote
Posted : 06/01/2019 1:31 am
armresl
(@armresl)
Community Legend

Hi,

Some context on what we are looking at would help.
That is a screenshot of what?
How did you get the data, what are you looking at it with, etc, etc.

Hi,

Hopefully this fits in this section. I am in the middle of attempting to recover deleted Facebook Messages, but am now stuck.
I am unsure of what types of files these are and how to open or use them?

Any help is appreciated.

ReplyQuote
Posted : 06/01/2019 4:29 am
aolney
(@aolney)
New Member

Hi,

Some context on what we are looking at would help.
That is a screenshot of what?
How did you get the data, what are you looking at it with, etc, etc.

This is a screen shot of the documents folder
It was pulled using Phone Rescue and these are the files inside the messenger app folder.
It looks like all the files are named after Unix Timestamps.

ReplyQuote
Posted : 06/01/2019 4:44 am
gungora
(@gungora)
Junior Member

I am not familiar with Phone Rescue but a good starting point might be to identify the file types you have from their binary signatures. You could use a forensic suite such as X-Ways, or something along the lines of TrID for this.

Once you have the file type predictions, you might want to start by exploring database types (e.g., SQLite) if any.

Is 6/28/2016 the date when this data set was exported?

This is a screen shot of the documents folder
It was pulled using Phone Rescue and these are the files inside the messenger app folder.
It looks like all the files are named after Unix Timestamps.

ReplyQuote
Posted : 08/01/2019 12:54 am
aolney
(@aolney)
New Member

5/11/2016 is the date the files were exported. I am curious to where you got 6/28/16 from. Thanks for your help so far!

ReplyQuote
Posted : 09/01/2019 1:08 pm
aolney
(@aolney)
New Member

Sorry just realized that the date modified says 6/28/16

ReplyQuote
Posted : 09/01/2019 5:51 pm
Share: