Trying to gather evidence from chat fragments in pagefile

Yes, nearly impossible.

The paging file is made up of memory pages copies from active applications and the operating system. The pages from different applications are mixed up, so pages might not be sequential. Even within a page the data might not be sequential in time or encoded, depending on the application and how it stores the data.

Also don't expect the paging file to contain a full record of anything. It will be a few fragments at best.

You might be better off by using a specialized tool like ours. Belkasoft Evidence Center (Pro and Ultimate editions) include the ability to carve page and hibernation files as well as live memory dumps for chat remnants in many IM formats including Windows Live Messenger. You're welcome to try it; the download is here http//forensic.belkasoft.com/en/bfs/en/download.asp

And here's the "how-to" http//forensic.belkasoft.com/en/bec/en/Carving.asp

You might be better off by using a specialized tool like ours. Belkasoft Evidence Center (Pro and Ultimate editions) include the ability to carve page and hibernation files as well as live memory dumps for chat remnants in many IM formats including Windows Live Messenger. You're welcome to try it; the download is here http//forensic.belkasoft.com/en/bfs/en/download.asp

And here's the "how-to" http//forensic.belkasoft.com/en/bec/en/Carving.asp

Can you tell me what the usual results you get from that software look like? Will there be any reference to the account-email or time reference for the chat fragments?

If you have EnCase then I wrote an EnScript to do this very thing, the version 6 one is available here
https://support.guidancesoftware.com/forum/downloads.php?do=file&id=819
and the version 7 spin is available in the App Store (for free).

Have a look at this document
http//computerforensics.parsonage.co.uk/downloads/MSNandLiveMessengerArtefactsOfConversations.pdf
which gives a fair bit of info about the older Messenger versions and the search for protocol messages.

Basically you need to search the whole of the drive for the pitch and format flag "PF=[number]" (if memory serves me correctly) the message (if there are any, and there are usually a fair few false positives) will follow soon afterwards in plain ASCII text.

These protocol messages have no embedded time stamps. The messages received from the remote machine contain the email address of the sender in the header, the one's sent from the local machine do not. I have seen these protocol messages in stand-alone 'gateway.txt' files which of course have a time stamp but it is much more common to find the messages in the page/swap file or in unallocated space where there is no time/date information. After extensive use I can say that sometimes you can find oceans of messages, sometimes a few, and occasionally nothing. That is my experience anyway.

Read the document and do a grep search or spend money on the Belkasoft solution, its up to you 😉

Good hunting,

Paul

Can you tell me what the usual results you get from that software look like? Will there be any reference to the account-email or time reference for the chat fragments?

The result is a list of extracted fragments with timestamp and some other info, depending on the chat type. Something like this