Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20117

General Discussion: Identifying the message direction in Skype's Message table

$
0
0
Hello, I carved some deleted Skype records from a main.db file and all the record fields seem to be correctly read, including the last ones, so the records have certainly not been overwritten (I also validated the header and payload lengths and every offset matches), however I'm having some issues with the chatmsg_status field. According to many websites chatmsg_status is supposed to have value 1/2 for outgoing messages and 3/4 for received messages but that doesn't seem to be always the case. Basically my problem is that there are messages where the author/sender is the Skype account owner yet the message is marked as incoming, way too many to be some coincidental corruption. So the questions are: is that an expected behavior? Does Skype accidentally saves those record incorrectly? Is my idea of basing the direction of the message on whether the author/sender is the Skype account owner really the most reliable way to determine the direction or is there any better way? Also is there any documentation I could attach as proof that those are still valid messages? Thanks in advance for the attention, Francesco

Viewing all articles
Browse latest Browse all 20117

Trending Articles