±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35742
New Yesterday: 3 Visitors: 110

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Microsoft Messenger User Cache.plist

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Chris55728
Senior Member
 

Microsoft Messenger User Cache.plist

Post Posted: Mar 21, 13 20:55

I have a job where the above file (on a Mac) contains email addresses that are relevant.

The file is located in the '\1 Customer\Macintosh HD\Users\<username>\Library\Preferences\Microsoft' directory.

From looking through the file and parsing the data, there appear to be a number of 'sections' per email address as follows:

- Allow List
- Block List
- Forward List
- Group List
- Pending List
- Reverse List

In my example it goes something like this:

- Allow List
loads of email addresses
- Block List
a few email addresses
- Forward List
loads of email addresses
- Group list
no email addresses
- Pending List
no email addresses
- Reverse List
quite a few email addresses

I've had a Google around and although there are lots of references to fixing Messenger when it doesn't work (by deleting the file), I can't find anything that explains what the file is, does or contains.

Going by the 'sections' I would hazard a guess at the following:

- Allow List - email addresses of friends on Messenger.
- Block List - email addresses of blocked individuals on Messenger.
- Forward List - ?
- Group List - ?
- Pending List - email addresses of people who have not yet approved a 'friends' request on Messenger.
- Reverse List - ?

Does anyone have an idea what the file is and what the various 'sections' refer to?

Cheers,

Chris  
 
  

BitHead
Senior Member
 

Re: Microsoft Messenger User Cache.plist

Post Posted: Mar 21, 13 21:34

The allow and block lists were pre-Messenger 2011 lists.

MSN had Allow Lists and Block Lists which were different than your contact list. The Allow List enabled you to maintain a separate list of people who were allowed to see your presence and IM you, but you did not have to have them in your Contact List. The Block List was people that could not send you IMs or get your presence when you were online.

In Messenger 2011 and on, your Contact List IS your allow list; the people that can see you when you come online and can IM you.  
 
  

Chris55728
Senior Member
 

Re: Microsoft Messenger User Cache.plist

Post Posted: Mar 26, 13 16:53

Thanks for the reply BitHead...I've got a few more questions if I may?

1. Are the email addresses in the Block List individuals that you have been 'friends' with on Messenger and subsequently blocked, or are they just email addresses that you have added to your Block List?

2. I don't suppose you have any idea what the Forward, Group, Pending and Reverse Lists are?

Cheers,

Chris  
 

Page 1 of 1