Knowledgebase:
Investigating Hello Chat Databases
Posted by Jack H. Ward, Last modified by Jack H. Ward on 07 February 2018 04:50 AM

Hello chat databases are located in the folder with the Hello user nickname.

To investigate Hello chat databases, do the following:

1. Have the Add New Evidence window open.
2. In the Category list, select Chat Database. In the Source Type list, select Hello database. Click OK.



3. In the Browse For Folder window, navigate to the location of the source folder. Click OK.
4. Enter the Evidence name (opened folder name by default) and click OK.
5. The Hello chat database is added to the case. Saved conversations are displayed in the Data View pane and in the special RTF viewer.

Hello chat database can contain images that can be examined.

To view images, do the following:

1. In the Case Content pane (to the left), select the Thumbnails node.
2. The contents of the node are displayed in the Data View pane (to the right). Images are displayed as thumbnails in the Thumbnails pane (at the bottom part).

3. Double-click the image in the Thumbnails pane to open it in the File, Hex, or Text viewer (make sure that these viewers are enabled).
4. To enable the File, Text, and Hex viewers, click the corresponding item on the View tab.



Attachments 
 
 Hello Chat database.png (35.71 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)