WindowsLiveContact Files

Does anyone know what kind of info is contained in WindowsLiveContact files? These files I talk about are placed in Documents and Settings\<user>\Contacts\<hotmail_email_address>\

In case this informations is forensically useful… how can you decrypt it?

Just out of curiosity, if you don't know what's in the files, how do you know that it needs to be decrypted? Doesn't that imply that you already know that the data is encrypted?

Uhmmm… in fact I believe I assumed too early they are encrypted, but, taking into account that opening them in a plain text editor I can't understand anything, I thought they must have been somehow encrypted.

currently work is in process to see what information they contain and how to read these files.

I believe they relate to contact and address book information but it doesn't seem possible to associate them back to a contact in the stg file.

the forensicbox@gmail.com guy is doing some good work in this area i think thats his email (see the previous topic on WLM)

See Page 52 of this document
Vista Forensics - Barrie Stewart (Final).pdf
Download from here
http//personal.cis.strath.ac.uk/~bastewar

I am the creator of the forensicbox tool and the contents of the .WindowsLiveContact files are not the same as stated in the document by the previous poster. The livecontact files are used for a beta service of the Live range products for sharing contacts on a website.

http//dev.live.com/contactscontrol/

The Windows Live Contacts control is a client-side browser JavaScript object that enables visitors to use their Windows Live Contacts with your Web site.

The decrypted content of this file is mostly binary data for authentication purposes. I still need to do some research if anything usefull can be found.

Can the windows live contact files be related back to a computer user's contacts list (members.stg) I would be very interested if that can be shown.???

Can the windows live contact files be related back to a computer user's contacts list (members.stg) I would be very interested if that can be shown.???

At the moment there is no known way that I know of. The contents are mostly binary and some GUIDs. I think the guids are used to retrieve the contacts form the live servers. I hope to do some research on this the coming month.

Sorry r3verse for the mis-information. Excellent document you wrote. Very helpful. Keep up the good work.

See Page 52 of this document
Vista Forensics - Barrie Stewart (Final).pdf
Download from here
http//personal.cis.strath.ac.uk/~bastewar

New link for the file
http//whereismydata.files.wordpress.com/2009/09/forensic-implications-of-windows-vista.pdf