Pardon me if this had been post before.
I'm working on retrieving MSN Messenger log to show the communication between two parties.
What the way to go about retrieving any log or evidence to show the contents of what they were "talking" through MSN?
Any help will be appreciated.
Thanks in advance.
The default location for saved IM sessions in XP
Documents and Settings\username\My Documents\My Received Files\screen_namexxxxxxxxxx\History
Files are saved in XML format.
If a user has enabled chat logging the Registry points to the location of the files NTUSER.DAT\Software\Microsoft\MSNMessenger\PerPassportSettings\##########
BitHead, thanks for your reply.
Any tool to recommend for retrieving the information out from the registry?
If MSN logging is off, user still has option of saving live session.
This by default will be saved as an RTF format to My Docs if I remenber correctly.
Access data Registry Viewer I use.
Failing that a search of screen names, email addresses being used or a search for "Never give out your password or credit card number in an, instant message conversation" which appears at top of each chat session, to find traces of chat sessions
SP
If a user has enabled chat logging the Registry points to the location of the files NTUSER.DAT\Software\Microsoft\MSNMessenger\PerPassportSettings\##########
Out of interest, I looked at my own system (XP Pro SP2) and, whilst there are plenty of entries in this area, they are all empty (I've never enabled logging). The ########## represent a selection of decimal numbers and I presume that they can all be deleted? Any idea how the numbers are generated? It doesn't look as simple as the date/time of the conversation.
If I recall correctly the 10 digit number is randomly generated.
So, if there are MSN conversations held in the registry, I guess I'd have to open each of these keys to get details of the conversations. That seems very long-winded!
The Registry just points you to where the files are stored. The conversations are stored as individual XML files.
Yes, but if there are several ########## entries in the registry (as there are in mine), does each point to a separate folder, each containing one XML file, or is there just one folder containing several XML files, presumably one per conversation?
I've disabled MSN ages ago and don't need or want it on my PC now.
Hi guys, I manage to find them in Documents and Settings\username\My Documents\My Received Files\screen_namexxxxxxxxxx\History
Any way to parse out the data? As it is in xml format, anyway to make it more readable for presenting the finding?