SQLite queries

356

DFIR Tools

License Type
Free
Forensic Utilities - Misc
Database Forensics
Browsers

Skype (version 7.21 & 7.41 dBs)

  • skype_main.sql
    Query Skype's (Classic) main.db for chats & file transfers.

  • skype_cache_db
    Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\ 

    • 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc)
    • 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
  • PowerShell script/sqlite query so that you can view the Hex Blob output

Google Drive  

  • Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\user@' folder .
  • Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder 

Android  

IOS  

Windows 10 Apps  

User comments

There are no user comments for this listing.
Already have an account? or Create an account