This script parses cached messages and profile-information from the 'messagesv12' and 'profilecachev8' tables of Skype 's4l-*' SQLite-database files.
Regardless of selection, the script will only process *.db files with a name beginning 's4l-'.
Output is by way of a SQLite-database file, note bookmarks, and the console.
Tests have shown that messages aren't stored in chronological order, so the output database will contain a view that sorts the messages first by source-file-path and then by composed date.
This view will also match each messages's 'creator' field to the 'displayNameOverride' field of profiles in the 'profilecachev8' table. In addition, it will also present the composed and created timestamps in a human-readable format.
The output database will also contain two views showing records derived from the 'profilecachev8' table.
One view will show authorised profiles (contacts) only. The other, all cached profiles.
Both views will present each profile's gender as a human-readable value. This assumes that 1 represents male and 2, female.
These views will also display phone-numbers as a flat-list in a column called 'PhoneList'.
Not everything is known about Skype S4L databases, so the script will include the content of the source 'nsp_data' field from each record for validation purposes.
SQLite Expert can be used to view the output database. Tablular views presented by the application can be copied and pasted into Microsoft Excel.
For additional information, please see the following Twitter post:
This script was developed for use in EnCase training. For more details, please click the following link:
734 items
1 item
169 item
13 item
237 item
10 item
88 item
9 item
211 item