Lecture 13: Case study 3: IM Forensics

Question 1

Skype - important databases/tables

Answer 1

main.db

Question 1

Potential evidence Skype

Answer 1

• Account information
• Contact information
• Call log
• Chat logs
• File Transfer

Question 2

Whatsapp - important databases/tables

Answer 2

• ChatStorage.sqlite –> ZWAMESSAGE
• Contacts.sqlite –> ZWAADDRESSOOKCONTACT

Android
- msgstore.db –> messages
- wa.db –> wacontacts

Question 3

Viber - important databases/tables

Answer 3

Contacts.data –>
ZABCONTACT (All contacts found on the phone)
ZATTACHMENT (All the attachments exchanged)
ZCONVERSATION (List of unique conversations)
ZPHONENUMBER (List of phone numbers)
ZRECENT (List of recent calls)
ZSTICKER (Data related to the sticker icons)
ZSTICKERSPACKAGE (Data related to the available sticker packages)
ZVIBERLOCATION (Latitude and longitude of each
message sent_
ZVIBERMESSAGE (List of messages exchanged)

Android:
- viber_data (calls, phonebookcontact, phonebookdata, vibernumbers)
- viber_messages (messages, participants, participants_info)