Dig out deleted cha...
 
Notifications
Clear all

Dig out deleted chat messages of App Skype

12 Posts
3 Users
0 Likes
468 Views
(@gorvq7222)
Posts: 229
Reputable Member
Topic starter
 

Last month Candy was arrested on suspicion of having doing online porn webcam shows, but Candy refused to confess to her crime. The Police extracted data from her iPhone and found lots of chat messages in Skype’s database – main.db.

Unfortunately there was no clear evidence in main.db. But forensic guys did not give up easily. Another senior examiner found some interesting chat messages in Skype “chatsync” folder. You guys could take a look at my blog to see the screenshots
http//www.cnblogs.com/pieces0310/p/5816027.html

According to the chat messages Candy sent, we could see that she gave a link to her client and invited him to create a profile.

The examiner visited at that link and found a porn website about online porn webcam shows.

The Police showed Candy what they have found in her phone. Candy was shocked and admitted her guilty. Candy was wondering why the Police could dig out those chat messages being deleted several months ago.

The truth is that those deleted chat messages still could be found in files inside Skype chatsync folders.

 
Posted : 28/08/2016 6:38 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Last month Candy was arrested on suspicion of having doing online porn webcam shows.

Out of curiosity, which kind of crime is that (and in which Country is it a crime?)?

jaclaz

 
Posted : 28/08/2016 8:09 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

Here is an overview software which can do it. wink

Extracting Evidence from Destroyed Skype Logs and Cleared SQLite Databases

https://articles.forensicfocus.com/2013/11/26/extracting-evidence-from-destroyed-skype-logs-and-cleared-sqlite-databases/

 
Posted : 28/08/2016 8:09 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Here is an overview software which can do it. wink

Extracting Evidence from Destroyed Skype Logs and Cleared SQLite Databases

https://articles.forensicfocus.com/2013/11/26/extracting-evidence-from-destroyed-skype-logs-and-cleared-sqlite-databases/

Well to be fair, in this particular case seemingly just carving *.dat for "http//" would have produced the same result ….

…and BTW the bit.ly link viewable on the screenshots of the hex view is still active and still leading to some sort of (presumably) p0rn webcam site …

jaclaz

 
Posted : 28/08/2016 8:26 pm
Igor_Michailov
(@igor_michailov)
Posts: 529
Honorable Member
 

…and BTW the bit.ly link viewable on the screenshots of the hex view is still active and still leading to some sort of (presumably) p0rn webcam site …

jaclaz

The article does not contain any screenshots.

 
Posted : 28/08/2016 8:54 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The article does not contain any screenshots.

Not your article, of course, the one linked to by the OP, about the p0rn webcam criminal "Candy".

jaclaz

 
Posted : 28/08/2016 9:33 pm
(@gorvq7222)
Posts: 229
Reputable Member
Topic starter
 

Hi Jaclaz,
As I know the crime which she was charged was "indecent exposure".

 
Posted : 29/08/2016 6:32 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Hi Jaclaz,
As I know the crime which she was charged was "indecent exposure".

Hmmm. ?
And what country is that? 😯
I mean "indecent exposure" is generally intended as "public exposure", someone inviting someone else (through a login/access site on the internet) to a peep-show is hardly "public".

jaclaz

 
Posted : 29/08/2016 6:45 pm
(@gorvq7222)
Posts: 229
Reputable Member
Topic starter
 

Sorry I'm not familiar with law or regulation. What forensic guys need to do is to extract data and find out what's going on. No comment for specific cases.

 
Posted : 30/08/2016 6:30 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Sorry I'm not familiar with law or regulation. What forensic guys need to do is to extract data and find out what's going on. No comment for specific cases.

You don't need to be familiar with Law, nor to provide a comment, you posted a story, I asked you WHERE it did happen, and not asking for particular location, just the country or state where it did happen (if it actually happened), as it sounds to me extraordinary (very unusual) that the Police (or the "forensic guys" or both) had the time and will to do a forensic analysis of a phone [*]for a crime that seems like not being particularly serious (and actually AFAIK isn't a crime at all in many countries, assuming that "Candy" and her "client" are both adults).

Of course you are perfectly free ) to keep that piece of info reserved, no problem.

jaclaz

[*]actually since "common" forensic investigator were not able to find anything, a second exam by a senior examiner was needed

 
Posted : 30/08/2016 1:04 pm
Page 1 / 2
Share: