I am a digital evidence investigator currently working with the Devon and Cornwall Constabulary on a child abuse investigation where the product MSN Messenger/windows live has been used.
I know this product is now defunct and has joined with SKYPE however I was wondering if it would be possible for anyone to answer a couple of questions which will help with my case, any help would be gratefully received.
When I have previously used MSN I know that my contacts etc travel with me when I log onto the programme from a different location. Can anyone confirm that the contacts.edb updates when any changes are made and these changes are roaming in that if I add a contact from one location and move to another log into my account again the contacts.edb file on the second device will be updated with my new contact. I know this must be the case but need to show this forensically.
If I have opted to save my chat logs when using the programme, I know from research I have undertaken these get stored within my received files. Can anyone help confirm forensically that chat logs are not roaming and will remain on the device from which they have taken place?
The contacts.edb database has a number of tables within it which hold contacts details. Can anyone shed any light on the difference between the Members Table and the Simple Contacts Table. I have a user which is listed in the Members Table and not in the contacts table. Is it that the members table contains all contacts deleted or not and the simple contacts keeps current contacts only?
There appear to be various dates and times logged within the members table of the contacts.edb file. Can anyone help me with a breakdown of what the following specific dates and times represent “Joined Date”, “Service/Last Change” and “Change Number”.
I also note the Members Table of contacts.edb contains a column headed role and this appears to be populated with the words “Allow” “Hide” etc. does anyone know what these words mean? I appear to have two entries of relevance in this table for one user, one has the words Allow and the other Hide.
Many thanks in advance for any assistance anybody can provide.
See if any of these can help you (respectively Italian and Portuguese, but not hat bad through Google translate
http//
http//
IF I get it right, the "member" table lists sent a received invitations, whilst "Simplecontacts" are the actual contacts.
jaclaz