I received a Google Takeout download that includes the Hangouts.json file, which contains a number of chat messages. Does anyone have a tool or process you'd recommend to parse the data from this file into a more usable format (e.g., a spreadsheet or similar report)?
I'd prefer not to use an online JSON converter, given the sensitivity of the case. I've come across a few that state all data remains local, but it's difficult to judge the credibility of those statements.
Any help would be appreciated.
Todd,
What tools do you have in your arsenal currently?
X-Ways, Proof Finder, BlackLight, and FTK Imager
Hi Todd
Just in case you are not receiving notifications please check your pms.
Paul
Did you see this tool https://
Features
Read all hangouts conversations and quickly switch between them.
It's all JavaScript in one html file! No need to upload your chat history to an unknown source.
View images inline with thumbnails.
Emoji support by twemoji
If you have merged Google Voice and Hangouts you will also see your Google Voice conversations.
Converter tools are convenient, but BEWARE….converters can skip data that is not predefined or expected. An example of this is the LocationHistory.json file that is created by Google. If you are only interested in location data that is available, then you can use most JSON converters for this. However, there is data in this JSON file that does not have a LAT/LON. This data includes user activity where no LAT/LON was recorded, but may still be important to your investigation. When Google is served a search warrant for the location information, they will use a converter, and supply the LocationHistory file in an Excel format. But the converter used by Google will skip the entries in the JSON file that do not have a LAT/LON associated with them. The result is that you will see a donut hole in the data that can make it appear that there was no activity, when there is data for that time period where no location information was being reported. But the JSON file will have speed, tilt, and other data available that will not be converted.
I have used python scripts, and Windows applications, that convert the JSON file, but fail to extract those items that have no LAT/LON.
Also, be advised that a Hangouts converter would not work with a Location History, and versa vice. I have asked that Magnet Forensics and Oxygen Forensics include an extractor for these takeout files.
I use JSONBUDDY to view the JSON file. You have to convert the UNIX Timestamp to a human readable data and time. You can only view all of the information in the JSON file by opening it in its native format.
Regards,
Todd Gabler
