I tried to solve the original question, but after spending a few minutes typing I decided to just recommend trying our tool, which implements everything I tried to describe. Evidence Center can acquire everything from Skype logs, including deleted records stored in so-called "freelist" areas (I'm pretty sure that the way we implemented freelist analysis in our tool is rather unique).
↧