Hi. D
Is there anyone who can point me in right direction to spoot Windows live messenger (wlm) password. In vmware i can use several tool that can recover windows live messenger password (if "remember password" checkbox is ticked in windows live messenger). Is it posible to recover WLM in an more forensic way, where is WLM password stored?
Knut Erik Rame
Rogaland police department
Norway.
There are lengthy descriptions of the various IM programs and associated artifacts on the forensic wiki. Recovery of the Unique ID, Contacts, Folders, etc., however, I am not sure how you recover a user's Windows Live ID password. I would be interested in the method you use in VMWare. Perhaps you could add it to the wiki.
Also a helpful program for IM analysis is ForensicBox.
Thanks for the wiki tips. I know of fbox, and different (forensic study - Digital investigation 13. june 2007) kinds of actefacts left by WLM. I`m trying to find where WLM password is stored, if it`s encrypted, how is it encrypted, how to retrive WLM password?
Knut Erik Rame
Rogaland police department.
Hello,
Because this forum is public viewable I can not provide details about the storage of passwords. You can use my program forensicbox to retrieve the password. For technical details you can email me (LE use only).
Theres lots of free tools at Nirsoft which recover these passwords for you on a live system. Perhaps some playing with them and sysinternals tools may provide some clues!