Skype chat databases are located in the folder with the Skype user nickname or in the main.db file.
Chat database default location:
Windows 7, 8, 8.1, 10
For Skype version lower than 4.0: C:\Users\<windows_username>\AppData\Roaming\Skype\<Skype_username>
For Skype version 4.0 or higher: C:\Users\<windows_username>\AppData\Roaming\Skype\main.db
The Application Data folder (AppData in Windows 7, 8, 8.1, and 10) is hidden by default.
To investigate Skype chat databases, do the following:
1. Have the Add New Evidence window open.
2. In the Category list, select Chat Database. In the Source Type list, select Skype database. Click OK.
3. In the Select source for mounting window, select the Folder option to open the folder containing the chat database. Select the File option to open the db file. Click OK.
4. If you select the Folder option in the Browse For Folder window, navigate to the folder containing the Skype chat database and click Open. If you select the File option in the standard Open window, navigate to the db file and click Open.
5. Enter the Evidence name (by default, the name of the file/folder to be added) and click OK.
6. The Skype chat database is added to the case. Saved conversations are displayed in the Data View pane and in the special RTF viewer.
You can view the information about users' IP addresses in the Contact IPs node in the Case Content pane.
The information includes:
- User ID
- Local IP
- Public IP
- Time when the user sent a message via this IP