Hi
Is anyone aware of a method for matching a particular contacts.edb file to a Windows Live address? I am examining a Vista Home Basic OS with 1 user account. I believe it has been used by 3 separate WLM accounts.
I extracted the contacts by using a VM and NirSoft LiveContactView. I have a strong suspicion which edb file belongs to which profile based upon keyword searches and cross referncing contacts.
I need a more reliablemethod which stands up to testing and is repeatable. What is the link between an MSN profile and the contacts.edb?
Cheers
Dan
OK. A little more work and I found it. The link between the Contacts.EDB and the WLM profile appears to be in the NTUSER hive file under
Software\Microsoft\Windows Live Contacts\Database
This key clearly states which GUID applies to which WLM address. Each WLM address has a main contacts file and a back up.
Cheers
Dan
But you only have the contacts.edb, contacts1.edb, contacts2.edb, etc… And these files do not show which msn accounts they belong to.
Even if you have all the msn accounts which have logged in, you still can not now which contact.edb file belongs to which msn account.
So, any other way of figuring out?
I've done some more testing and have further confirmed my results. The registry key below states the directory (named by GUID) which contains the contact.edb file
HKCU\Software\Microsoft\Windows Live Contacts\Database
If multiple WLM accounts have logged onto WLM under a single user account then the above key contains multiple entries. Each WLM address has 2 entries - 1 current database anmd 1 shadow database. The registry entry shows the directory name (GUID)which stores the contacts.edb database for that particular WLM account.
In Vista the contacts.edb files are located at
\Users\[Name]\AppData\Local\Microsoft\Windows Live Contacts\[GUID}
I've tested this with multiple WLM accounts, each with different addresses in thier contacts list and so far it stands up to scrutiny.
Dan