The “ thread_summaries” table goes one step further and provides the name for all Facebook message threads, the timestamp of the last message in the thread, and the custom name of the group. Thankfully, the table does give you a thread id and a timestamp of the message. It appears that Facebook stores all of a user’s messages on their servers and then assigns it a “msg_id” within the “messages” table to link specific messages. Unfortunately, you will not find any actual message content within this database. orca2.db:įinally we arrive at the database responsible for handling user messages. “p2p_transfers” holds much of the same information for instances where the client’s user account has sent money to another Facebook id. There will also be a declined/accepted request status, the currency that is expected, request creation time and updated time, along with the memo attached to the request and url/Facebook thread id of the request. Here you will find the Facebook id of the person who is requesting money, the id that is associated with this request, who the payment is being requested of, and the transfer id will appear for any completed transfers.
The path to this database is:Ĭ:\Users\\ AppData\ Local\Packages\ Facebook.317180B0BB486_8xx8rvfyw5nnt\LocalState\AppData\Local\osmeta\_store_5CBB0E4E-4F61-4478-A100-02BCCA1563B0\p2p_payments_store.v2\Īll payment requests made to the user’s account are logged in the “ p2p_requests” table. Within this table you can retrieve information on past payment requests and successful transactions. Many forget that Facebook has its own embedded point-to-point payment system. This includes the last check for messages, contacts, calls, and updates. Here you can find entries for the last times specific actions occurred.
“library_metadata” is the last useful table in this database. It provides semi-valuable fields such as a contacts name, if they are a friend, and even their phone number that is linked to Facebook. An investigator can see phone calls that have occurred on the system, along with more detailed info on any messenger contacts. “collection_index#” is the preface to a collection of tables that deal with contacts, calls, etc.
#Facebook messenger app windows 10 update
An investigator may be able to deduce particular actions such as when a message was pulled into the application and the last time the application had run an update request for messages, contacts, and threads. Possible logs entries may include the user’s client requesting a snapshot for contact/message collection or queuing. This table displays application data for the user account such as the last time the application ‘refreshed’ its different data. Of the 29 tables within this database, only three are of relevance to us. The majority of the data you will retrieve from this database is focused around user account logs and app details. These are fbomnistore.db, orca2.db, p2p_transfer.db, and searchstore.db. Along my careful search I found only four database files that have the ability to indirectly serve as possible case evidence. Although some sqlite database files do exist on Windows, they greatly differed from those on the mobile version. I went into this Windows app overview thinking I would find databases somewhat similar to those present on mobile devices. To my surprise, this application uses a beautiful blend of both local and cloud storage.
#Facebook messenger app windows 10 windows 10
What data is stored in Facebook Messenger from the Windows 10 App Store? Unfortunately, Facebook Messenger is not as friendly on the Windows 10 OS. Contacts, message conversations, timestamps, etc are all ripe for the investigator’s picking. Numerous tables exist within this local database (as of July 2018) that contain mountains of user data.
The app reached a billion users in 2017 and has been steadily increasing ever since (forbes).Ī typical smartphone device contains the ‘’ database, which is codename for the messenger project. For those of you unfamiliar, Facebook decided to better handle their traffic by creating the standalone “Messenger” application for all non-browser direct messages. If you have ever performed mobile forensics, chances are you’ve come across Facebook’s Messenger app.
0 kommentar(er)
