Knowledgebase:
Investigating ICQ Chat Databases
Posted by Jack H. Ward, Last modified by Jack H. Ward on 07 February 2018 05:27 AM

ICQ chat database is located in the folder with the ICQ user nickname.

Chat database default location:

ICQ
1999-2003,

ICQ 2003

Windows 7, 8, 8.1, 10

C:\Program Files\ICQ\<ICQ version number>\

ICQ 6,
ICQ 7

Windows 7, 8, 8.1, 10

C:\Users\<windows_username>\AppData\ Roaming\ICQ\<ICQ number>


The Application Data folder (AppData in Windows 7, 8, 8.1, and 10) is hidden by default.

To investigate an ICQ chat database, do the following:

1. Have the Add New Evidence window open. 
2. In the Category list, select Chat Database. In the Source Type list, select ICQ 2003b database, ICQ 1999-2003a database, ICQ6 database, or ICQ 7 database, depending on the version of the chat client. Click OK.



3. In the Browse For Folder window, navigate to the location of the source folder. Click OK.
4. Enter the Evidence name (opened folder name by default) and click OK.
5. The ICQ chat database is added to the case. Saved conversations are displayed in the Data View pane and in the special RTF viewer.







Attachments 
 
 ICQ chat database.png (37.16 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)