Tuesday, September 30, 2008

Skype Log Parser Update.......

Wow in the last 20 days this program has been downloaded over 290 times. I have received a few calls/email's about it and I thought I would update the program. There is still more to do with it but I thought I would post this update to it. The program can be downloaded here

What I have updated is to add parsing of the SMS records. This will parse the sms256.dbb, sms512.dbb and sms1024.dbb. I did not have a sms16384.dbb so that file will not be parsed. The report that will be outputted is the Messages that was sent and the phone number that it was sent to. I have yet to figure out where the date is stored so that is not included at this time. This is something I will be working on.

I have also added a timeline of all the transactions. This is similar to the "History" tab on the Skype program.

I am also planning on updating this program some more in the new future, add reports, parse voicemail, figure out the date/time for SMS messages, and other things. If you think something else should be added to it please shoot me an email, you can find my email somewhere on the blog or just leave a comment.

Thoughts/Comments/Questions?

40 comments:

J.Clauwaert said...

I'm an IT investigator with the Belgian Federal Police. I was looking for some application that could extract the Skype history and after testing a few programs stumbeled upon yours. A relief after the ones I used in the preceding hours: it actually worked.
I tested this program on a real case: I installed skype_logs.exe on a USB memorystick and used it on the targets (live) computer whith Vista installed on it.
Then I mounted an image (dd) of the target hard disk on my WinXP machine and repeated my actions.
A few observations:
- skype_logs did not generate a html report on Vista but did on my XP and opened the index.html after it finished.
- the \Users\...\Skype folder contained several subfolders for different users upon which I acted. One subfolder made the program hang on the XP machine, no error message was shown.
Read_skype_logs.exe was started whithin skype_logs.exe, taking up 50% of the processor time and having chat512.dbb open (share flags RW). On the Vista the program did not hang on the same subfolder but the databaserecords were not complete. That is, there are records (100 to 200 in some tables) but most of the fields were empty except for "skype_log_file" which shows mostly 2 or three different files (...256.dbb, ...512.dbb, ...1024.dbb, ...).
The numeric fields are always 0 but "sequence_number" is always 48. So it is primarily the fields wich are of type string that are empty.
- When clicking the taskbar icon the menu item "script paused" is always selected no matter if the program is paused or not.

Hope this is somewhat helpfull for future releases.

Regards,

David said...

Just wanted to say thanks for the program. It has helped me in a number of case and is a huge contribution to the forensic community.

Anonymous said...

Hi,
I'm using your Skype Log Parser against a chat512.dbb file (a 277kB long one) but, differently from other Skype Log Reports I obtained investigating such type of Skype's files, I can not obtain a Log Report of Skype Chats: I obtain a report with only a list of names for which conversations happened (eg. chat A between B happened but without any message between them).
Is a problem of the parser or a problem of the dbb file.
Thanks.
davide DOT poletto AT gmail DOT com

johnmccash said...

Mark - Did you ever get the SMS date format figured out? I have a case I'm working on where that's been requested.
Thanks
John

M.Smilga said...

I make experimet with chatmsg256.dbb and found time diferences. I compare original chat and parsed log. In parsed log is +16 sec.

Mark McKinnon said...

Which version are you using. There have been updates since this posting. For the latest and greatest go the the software page on my site http://redwolfcomputerforensics.com

Kind regards.

Mark

M.Smilga said...

Thank You
Yes i use older version :). This is cool programm, becouse parse only one small fragment of file. I take from unallocated cluster. No need all skype user folder.

Anonymous said...

The first misconception that wannabes might invariably have is Hogan could be marginally harder than mountain trekking. If Hogan scarpe donna was the case, Hogan uomo need not have to be stiffer and flexible simultaneously. Add to Hogan scarpe uomo the extra mid-sole cushion to make you forget the heavy thumping downhill running.st

CHEAPSOCCERUNIFORM said...

Summarizing what we think,a complete and coherent way. Thanks for writing it down so cleary.
Eeveryone love fashion clothing, Polo Ralph Lauren is very popular all over world, that is my dream to get Ralph Lauren Polo Shirts.We know Ray Ban by America soldier, all of them wear Ray Ban Sunglasses when they walk on the road, it is fashionable for you.

Penis Enlargement Pills said...

The article is worth while reading, I like it very much and which you shared the info in this post is very useful. Thanks for sharing a wonderful post.

Stacey said...
This comment has been removed by the author.
sports handicapping software said...

This is an interesting..... great information found here... Thanks very much!

Shawna said...

Really worthwhile info, lots of thanks for this article.

Chang bui thi said...

Thanks for sharing this quality information with us. I really enjoyed reading.
---
Signature:
i like play games juegosjuegos.com | jogos do friv | juegos de matar zombies

friv said...

I think I need it. Thank you
---
friv 2 | friv2 | friv games

baixar facebook said...

This is the perfect post! Thanks for sharing this with us loved reading your article
---
apply baixar facebook movel online free | baixar facebook | baixar facebook gratis

Facebook Descargar said...

I would like to thank you for your nicely written post
Signature:
descargar facebook
descargar facebook apk
descargar facebook gratis
descarga facebook

Mas un show said...

You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
Signature:
un show mas
juegos de un show mas
juego de un show mas
juego un show mas

Whatsapp Descargar said...

I understand what you bring it very meaningful and useful, thanks.
Signature:
download free descargar whatsapp
baixar whatsapp
descargar whatsapp gratis
baixar whatsapp gratis

iniciar sesion facebook entrar said...

This article is really fantastic and thanks for sharing the valuable post.
Signature:
facebook entrar iniciar sesion gratis - Sitio Oficial iniciado sesión en Facebook lengua española. facebook entrar rápido, facebook iniciar sesion en tu cuenta de entrar facebook

HaNa Chang said...

Very interesting! Thanks you
Signature:
download baixar facebook movel, Facebook movel, baixar facebook movel. Facebook chat, baixar whatsapp gratis, fazer o download baixar whatsapp para Android, iPhone. Últimas Facebook

unblockedgames said...

Doing so will better job security unblocked games 77 very nice , free unblocked games online online to play , descargar whatsapp para android chat limit , unblocked games , free unblocked games , descargar whatsapp gratis

Anh Mai said...

Great post,Thanks for providing us this great knowledge,Keep it up.
A good blog.
Signature:
Versión en facebook español descargar a los países hablan Español: facebook entrar direto agora , facebook en español descargar , facebook entrar direto agora

games unblocked said...

This is also a very good post which I really enjoyed reading. It is not everyday that I have the possibility to see something like this.
Signature:
The place to play all unblockedgames online. Here you can find every blocked games such as: unblocked games , unblocked games happy , unblocked games 77 ,

Whatsapp Descargar said...

What a great online source of information about this topic. you have done great work. keep continue to sharing such kinds of post. keep it up.
agario , descargar facebook , whatsapp messenger , descargar mobogenie , descargar whatsapp apk , cities skylines mod , five nights at freddy's

Yepi said...

You need to kill time, you need entertainment. Refer to our website. hope you get the most comfort.
Thanks you for sharing!
Yepi
Kizi
Friv
Friv Games

Hieu Nguyen said...

you'd have time to look these kids active. Please visit our website and let us play the game interesting.
Thanks for sharing !
Friv 10
Kizi 10
Yepi 2

Friv5 said...

You need to kill time, you need entertainment. Refer to our website. hope you get the most comfort.
Thanks for sharing !
Friv 5
Kizi 1
Yepi 3

Friv4 said...

When you're tired, you want to relax after a stressful working hours, you need to have time to take care of the kids active.
Please visit our website and play exciting flash games.Thanks you for sharing!
Friv 4

Kizi200 said...

Play the Best Free Games! We've picked out the racing games, cooking games, candy crush, games shooting, fashion games, ...
Thanks for sharing !
Kizi 200
Friv 1
Y88
Y9

Friv100 said...

You want to relax after a stressful working hours. Refer to our website. hope you get the most comfort.
Thanks for sharing !
Friv 100
Friv 8
Friv 2

GirlsGoGames Dressup said...

You want to relax after a stressful working hours. Refer to our website. Hope you get the most comfort.
Thanks for sharing !
GirlsGoGames
Kizi 100
Frvi

games2girls said...

You need to have time to take care of the kids active. Please visit our website and play exciting flash games.
Thanks you for sharing!
Games2Girls
Kizi 1000
Frin
Friv 3

Giải Trí Tổng Hợp said...

The blog or and best that is extremely useful to keep I can share the ideas. Age Of War 2
Big Farm | Slitherio | Tank Trouble
Of the future as this is really what I was looking for, I am very comfortable and pleased to come here. Thank you very much.
Happy Wheels | Goodgeme Empire | Slither.io

gun mayhem 3 said...

Thank you for visiting our site. Sure you will feel is amazing. Since we have been very selective as many games and you can play online for free
gun mayhem 3 | tank trouble 3
learn to fly 3 | happywheels
tank trouble |

hường lê said...

Such a very useful article. Very interesting to read this article.I would like to thank you for the efforts you had made for writing this awesome article.

Discover our website bounty of free online games now!
Our website has the biggest collection of free online games. Totally new games are added every day!

age of war 2| gold Miner 2| unfair Mario 2 | cubefield 2 |tanki Online 2


Megan Nicole said...

Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write
wings.io | super mechs | wingsio play | super mechs 2 | wingsio game | supermechs

Eric Trump said...

Thanks for sharing this good stuff! Keep up the great work, we look forward to reading more from you in the future!
Friv 100

nguyen thanh truc said...

Games are games of human intelligence.
Join experienced talent with me yet! What are you waiting for?
age of war 2
gold Miner 2
unfair Mario 2
cubefield 2
tanki Online 2

Friv Games
Y2
Friv 200

y8 said...

You need to have time to take care of the kids active. Please visit our website and play exciting flash games.
Thanks you for sharing!
Y8 Games
Friv 1000
Friv 4