I have got a forensic copy (E01), I exported the data's. Now, someone need the skype chat. Where are they stored?
On a Windows XP system
\documents and settings\<user name>\application data\skype\<skype user name>
Windows 7
C\Users\<user name>\AppData\Roaming\Skype\<skype user name>
Mac
library/application support/skype/<user name>
SkypeAlyzer can help you decode the dbb and now more common db files
http//
If its any help, I have a tool named Skype Message Recovery which will get live and deleted messages (don't worry its free!)
http//
Thank you I will consider your free tool
thanks
On the subject of Skype, does anyone know if the timestamp with the db files comes from the local system or the server? I know I can test this myself, but was wondering if someone else already has.
Thumbs up for SkypeAlyzer. Worked a treat on a big case we had a few months ago. Contibuted to an early plea which everyone likes -)
On the subject of Skype, does anyone know if the timestamp with the db files comes from the local system or the server? I know I can test this myself, but was wondering if someone else already has.
My testing shows that they are taken from the local machine. You should however verify for yourself as obviously my testing is limited to the versions and platforms I have tested on - it only takes a few seconds.
Absolutely. Thanks Paul.
Hi,
We use Internet Evidence Finder, http//
JH
Internet Evidence Finder is a good tool, but does not find all records. I had a case recently where IEF recovered a single Skype Chat record and I managed to recover 500+ records.
Don't get me wrong, I'm not slating it, but I have noticed a reliance on this tool which can be dangerous.