IM Viewer

Are you looking for a dedicated tool like Paraben Chat Examiner or just viewing IM using EnCase or FTK? Do you need a forensic tool? If not there are many tools available.

Actually I need a forensic tool. I have try Paraben Chat Examiner Demo. But some of the messenger chat log cannot open.

Preferably, I need something that can let me view the sender, receiver, the date and time of message and the message itself. If able to tell the e-mail of the sender and receiver that will be good.

I need this so I can present it in a more readable format.

What about viewing it in EnCase or FTK, how do I go about doing it?

Thanks for the advice.

I have try Paraben Chat Examiner Demo. But some of the messenger chat log cannot open.

Which chat logs won't open and why some and not others?

Add0, I copy out the whole folder "Documents and Settings\username\My Documents\My Received Files\screen_namexxxxxxxxxx\" and try loading it in Paraben Chat Examiner.

And I got this message "There has been an error in loading the chat database. Please check the messenger type and database path."

Maybe is the wrong chat that I chosen or the wrong folder that I extracted.

Any advice on how to find out the chat version and type in EnCase and also which folder do I extract out?

Documents and Settings\username\My Documents\My Received Files\screen_namexxxxxxxxxx\History is the default location for MSN Messenger. I am guessing that is your target based on the location you posted. Chats are typically XML but can be RTF or TXT.

If the user has enabled chat logging the key is found in
NTUSER.DAT\Software\Microsoft\MSNMessenger\PerPassportSettings\#########\
If the value = 0 then logging is not turned on.

anyone find way(or program) to how get that logs?

(paraben not working)

http//computerforensics.parsonage.co.uk/downloads/MSNandLiveMessengerArtefactsOfConversations.pdf