Knowledgebase:
Adding Chat Database Evidence
Posted by Jack H. Ward, Last modified by Jack H. Ward on 29 January 2018 03:18 AM
Chat Database Evidence is a link to a database created by any instant messaging application.

To add new chat database evidence to the case:

1. On the Evidence tab, in the Evidence group, click Add Evidence; or right-click the case node and select Add New Evidence; or click Add Evidence on the Welcome screen. (If you add evidence before creating or opening a new case, the case will be created automatically and saved to the default location. The name of the case file will be e3).

2. The Add New Evidence window opens.


3. Select the Chat Database evidence category and the Source type. Use the Autodetect option to browse to a file or folder and have Electronic Evidence Examiner auto detect evidence for the selected category.


4. In the Select source for mounting window, select whether the evidence is found in a File or Folder and click OK.                                                                                                                                                                                                                                     

The following chat databases are stored in files:

Skype chat database

File main.db

Miranda chat database

File *.dat

 The following chat databases are stored in folders:

Yahoo chat database

Folder name is the Yahoo user nickname.

Skype chat database

Folder name is the Skype user nickname.

ICQ 2003b chat database

Folder name is the ICQ number

ICQ 1999-2003a chat database

Folder name is the ICQ number

ICQ6 chat database

Folder name is the ICQ number

ICQ7 chat database

Folder name is the ICQ number

Hello chat database

Folder name is the Hello number

Trillian chat database

Folder name is the Trillian number

MSN chat database

Folder  name is the MSN user nickname

5.  If you select the Folder option, in the Browse For Folder window, navigate to the folder containing the chat database and click Open. If you select the File option, in the standard Open window, navigate to the file and click Open.
The investigation of chat database evidence is possible with the following packages:
  • E3: Universal
  • E3: P2C
  • E3: Internet.


Attachments 
 
 Adding Chat Database Evidence 1.png (32.64 KB)
 Adding Chat Database Evidence 2.png (32.49 KB)
(0 vote(s))
Helpful
Not helpful

Comments (0)