Tuesday, September 30, 2008

Skype Log Parser Update.......

Wow in the last 20 days this program has been downloaded over 290 times. I have received a few calls/email's about it and I thought I would update the program. There is still more to do with it but I thought I would post this update to it. The program can be downloaded here

What I have updated is to add parsing of the SMS records. This will parse the sms256.dbb, sms512.dbb and sms1024.dbb. I did not have a sms16384.dbb so that file will not be parsed. The report that will be outputted is the Messages that was sent and the phone number that it was sent to. I have yet to figure out where the date is stored so that is not included at this time. This is something I will be working on.

I have also added a timeline of all the transactions. This is similar to the "History" tab on the Skype program.

I am also planning on updating this program some more in the new future, add reports, parse voicemail, figure out the date/time for SMS messages, and other things. If you think something else should be added to it please shoot me an email, you can find my email somewhere on the blog or just leave a comment.

Thoughts/Comments/Questions?

19 comments:

Anonymous said...

I'm an IT investigator with the Belgian Federal Police. I was looking for some application that could extract the Skype history and after testing a few programs stumbeled upon yours. A relief after the ones I used in the preceding hours: it actually worked.
I tested this program on a real case: I installed skype_logs.exe on a USB memorystick and used it on the targets (live) computer whith Vista installed on it.
Then I mounted an image (dd) of the target hard disk on my WinXP machine and repeated my actions.
A few observations:
- skype_logs did not generate a html report on Vista but did on my XP and opened the index.html after it finished.
- the \Users\...\Skype folder contained several subfolders for different users upon which I acted. One subfolder made the program hang on the XP machine, no error message was shown.
Read_skype_logs.exe was started whithin skype_logs.exe, taking up 50% of the processor time and having chat512.dbb open (share flags RW). On the Vista the program did not hang on the same subfolder but the databaserecords were not complete. That is, there are records (100 to 200 in some tables) but most of the fields were empty except for "skype_log_file" which shows mostly 2 or three different files (...256.dbb, ...512.dbb, ...1024.dbb, ...).
The numeric fields are always 0 but "sequence_number" is always 48. So it is primarily the fields wich are of type string that are empty.
- When clicking the taskbar icon the menu item "script paused" is always selected no matter if the program is paused or not.

Hope this is somewhat helpfull for future releases.

Regards,

Unknown said...

Just wanted to say thanks for the program. It has helped me in a number of case and is a huge contribution to the forensic community.

Anonymous said...

Hi,
I'm using your Skype Log Parser against a chat512.dbb file (a 277kB long one) but, differently from other Skype Log Reports I obtained investigating such type of Skype's files, I can not obtain a Log Report of Skype Chats: I obtain a report with only a list of names for which conversations happened (eg. chat A between B happened but without any message between them).
Is a problem of the parser or a problem of the dbb file.
Thanks.
davide DOT poletto AT gmail DOT com

johnmccash said...

Mark - Did you ever get the SMS date format figured out? I have a case I'm working on where that's been requested.
Thanks
John

M.Smilga said...

I make experimet with chatmsg256.dbb and found time diferences. I compare original chat and parsed log. In parsed log is +16 sec.

Mark McKinnon said...

Which version are you using. There have been updates since this posting. For the latest and greatest go the the software page on my site http://redwolfcomputerforensics.com

Kind regards.

Mark

M.Smilga said...

Thank You
Yes i use older version :). This is cool programm, becouse parse only one small fragment of file. I take from unallocated cluster. No need all skype user folder.

Anonymous said...

The first misconception that wannabes might invariably have is Hogan could be marginally harder than mountain trekking. If Hogan scarpe donna was the case, Hogan uomo need not have to be stiffer and flexible simultaneously. Add to Hogan scarpe uomo the extra mid-sole cushion to make you forget the heavy thumping downhill running.st

Penis Enlargement Pills said...

The article is worth while reading, I like it very much and which you shared the info in this post is very useful. Thanks for sharing a wonderful post.

Stacey said...
This comment has been removed by the author.
sports handicapping software said...

This is an interesting..... great information found here... Thanks very much!

Shawna said...

Really worthwhile info, lots of thanks for this article.

friv said...

I think I need it. Thank you
---
friv 2 | friv2 | friv games

Unknown said...

I would like to thank you for your nicely written post
Signature:
descargar facebook
descargar facebook apk
descargar facebook gratis
descarga facebook

Unknown said...

You’ve written nice post, I am gonna bookmark this page, thanks for info. I actually appreciate your own position and I will be sure to come back here.
Signature:
un show mas
juegos de un show mas
juego de un show mas
juego un show mas

Unknown said...

This article is really fantastic and thanks for sharing the valuable post.
Signature:
facebook entrar iniciar sesion gratis - Sitio Oficial iniciado sesión en Facebook lengua española. facebook entrar rápido, facebook iniciar sesion en tu cuenta de entrar facebook

Anonymous said...

Very interesting! Thanks you
Signature:
download baixar facebook movel, Facebook movel, baixar facebook movel. Facebook chat, baixar whatsapp gratis, fazer o download baixar whatsapp para Android, iPhone. Últimas Facebook

unblockedgames said...

Doing so will better job security unblocked games 77 very nice , free unblocked games online online to play , descargar whatsapp para android chat limit , unblocked games , free unblocked games , descargar whatsapp gratis

Unknown said...

Great post,Thanks for providing us this great knowledge,Keep it up.
A good blog.
Signature:
Versión en facebook español descargar a los países hablan Español: facebook entrar direto agora , facebook en español descargar , facebook entrar direto agora