Skype Chat Logs

There are two possibilities that spring to mind

1. The chat256.dbb, chat124.dbb files record a list of conversations. These show the history of the conversations and includ ethe first line of any new session. Not ideal but more than nother. I am in the process of adding support for these files to SkypeAlyzer.

2. Chat recording may have previously been enabled and the chats deleted leaving the remnants of chat in unallocated/swap file. I am also in the process of adding a deleted chat carver to SkypeAlyzer

More info here www.sandersonforensics.com/SkypeAlyzer.html

Support for both of these options has now been implemented.

The carving option is only available to registered users and is not in the demo version at the moment. It allows carving form individual files (monolithic images, direct from a disk/volume or from an encase .e01 file). It will find the various dbb fie fragmenst and determine what sort fo record they represent (contact, text messages, file trasnfer etc.) and output to a sutablly named file for processing as normal.

For those who expressed an interest SkypeAlyzer now includes support for UTF8 encoded chats - i.e. foreign lanuage sets.

Quick question, but does the oxygen version only do Skype from phones and no full computer installs?

I am looking for a "good" reliable Skype log viewer (not skype log viewer though) it seems to miss a lot of messages from the history?

Thanks
4R

Hey Guys
Wondering if you disable the skype chat log, is there a way to still recover what was being said in the chat among two parties? I know who is talking to who but need to know what was being said. Is there any way of producing this?

Thank you.

If the chat log was disabled from the beginning, the regular Skype history file will contain nothing. However, chatsync folder may contain parts of conversations. Also, hibernation and page files may contain the most recent Skype conversations.

All these kind of analysis are supported by Belkasoft Evidence Center tool.