99 - Sample Exam IM

Question 1

IM Forensics - Skype

Name the main databases for iOS & Android, the main tables and timestamp used?

Answer 1

1. main.db (iOS / Android)
2. Accounts
   Contacts
   Transfer
   Calls
   Messages
   CallMembers
   ChatMembers
   Conversations
   Messages
   Participants
   Voicemails
   Videos
3. unixepoch

Question 2

IM Forensics - WhatsApp

- iOS -

Name the main databases, the main tables and timestamp used?

Answer 2

1. ChatStorage.sqlite & Contacts.sqlite
2. ChatStorage.sqlite:
   ZWAMESSAGE
   (ZISFROMME: 0=received, 1=sent)
   ZWAMESSAGEWORD
   ZWACHATSESSION
   ZWAGROUPMEMBER
   ZWAGROUPINFO
3. Contacts.sqlite:
   ZWAMEDIAITEM
   ZWACONTACT
   ZWAPHONE
   ZWASTATUS
4. NSDate: +978’307’200

Question 3

IM Forensics - WhatsApp

• Android -

Name the main databases, the main tables and timestamp used?

Answer 3

1. msgstore.db & wa.db
2. msgstore.db:

• *chat_list**
• *Messages**
• (key_from_me: 0=incoming, 1=outgoing)*

wa.db:

• *wacontacts**
  3. unixepoch

Question 4

IM Forensics - Viber

• iOS -

Name the main databases, the main tables and timestamp used?

Answer 4

1. contacts.db
2. ZABCONTACT
   ZTEXTMESSAGE (ZDATE, ZTEXT)
   ZATTACHMENT
   ZCONVERSATION
   ZPHONENUMBERINDEX
   ZRECENT
   ZSTICKER
   ZSTICKERSPACKAGE
   ZVIBERLOCATION
3. NSDate: +978’307’200

Question 5

IM Forensics - Viber

• Android -

Name the main databases, the main tables and timestamp used?

Answer 5

1. viber_data & viber_messages
2. viber_data:
   calls
   phonebookcontact
   phonebookdata
   vibernumbers
   viber_messages:
   Messages
   (msg delivery status: 1=sent, 2=delivered; type: 0 = incoming, 1=outgoing)
   participants
   threads
3. unixepoch

Question 6

IM Forensics - Skype

Where are the database files located for macOS and Android?

Answer 6

macOS: /Users/USERNAME/Library/Application Support/Skype/USERNAME/

Android: /data/data/com.skype.raider/files/USERNAME/

Question 7

IM Forensics - WhatsApp

Where are the database files located for iOS and Android?

Answer 7

iOS:

• ChatStorage.sqlite*: /var/mobile/Applications
• Contacts.sqlite*: /private/var/mobile/Containers/ Shared/AppGroup

Android:

/​data/data/com.whatsapp/

Question 8

IM Forensics - Viber

Where are the database files located for iOS and Android?

Answer 8

iOS: /var/mobile/Applications/

Android: /data/data/com.viber.voip/