First, extract the object
Western Digital 4TB Red Disk used by suspects
Second, extract the demand
Need to extract the Skype chat history in the hard disk and form a corresponding report.
Remarks: Skype is an instant messaging chat tool with the functions required by IM, such as video chat, multi-person voice conference, multi-person chat, file transfer, text chat, etc. Currently, there are more than 600 million registered users.
Third, the solution
Skype chat records are stored in the form of SQLite database. If you need to extract chat records, you need to find the location of the sqlite database, and can automatically parse and generate forensic reports.
Fourth, the operation steps
1. For electronic data forensics, data extraction is usually performed according to the following process, as shown in Figure 1.
figure 1
2. The first three steps of the case for evidence collection have been carried out in accordance with relevant regulations, and will not be repeated here. Directly connect the hard disk to the computer equipped with the efficiency source DF electronic data analysis system through the read-only interface, as shown in Figure 2.
figure 2
Note: In order to prevent the hard disk from being written to data, the hard disk can only be connected through a read-only interface and must be physically read-only.
3. After the hard disk is connected, open the DF electronic data analysis system, create a new case, mirror the hard disk, and do a hash check, as shown in Figure 3.
image 3
Remarks: Mirroring is to achieve the solidification of evidence, to ensure the originality and objectivity of the data. Calculating the hash value ensures that no data is written.
(4). Load the image, extract the data, and view the storage path C:\User\Administrator\Application Data\Romaing\Skype\, as shown in Figure 4.
Figure 4
5. Click Auto Forensics to extract Skype chat data, as shown in Figure 5.
Figure 5
Remarks: DF automatically integrates the parsing method of sqlite data, which can directly extract chat records.
6. View the extracted Skype chat history, as shown in Figure 6.
Image 6
Note: In order to protect privacy, the key information in the picture is blurred.
7. Generate the forensic report of the Skype chat record that meets the judicial procedure, as shown in Figure 7.
Figure 7
Fifth, the extraction results
Through the above steps, the Skype chat record in the hard disk is successfully extracted, and a forensic report conforming to the judicial procedure is formed.
Summary
When conducting electronic data forensics, it must be operated in strict accordance with the standard procedures. It is strictly forbidden to write data to the hard disk. Efficiency Source DF Electronic Data Analysis System is a powerful electronic data forensics device that can extract data from Internet traces, chat logs, operation logs, etc., and analyze suspicious files and confidential documents. In addition, the device's powerful data recovery capabilities ensure the integrity and accuracy of the extracted data.
Synthetic Hair Extension is made of High Temperature Heat Resistant Fiber and can be made into a variety of hair styles, crochet hair can choose from a variety of styles. You can dye your hair, any color. Wholesale and retail, cheap prices, save your budget. Synthetic ponytails are easy to wear and synthetic hair Bun is easy to care for. Braiding hair can be made by DIY with different braids. With new hairstyles updated every day, alileaderbeauty will give you the most popular hairstyles.Find quality synthetic hair Products and Trade Leads from our International Trade Site Import & Export on alileaderbeauty.
Synthetic Hair Extension,Artificial Hair Extensions,Hairpiece For Butterfly Locs,Synthetic Hair Extension For Sale
Xuchang Le Yi De Import And Export Trade Co., Ltd. , https://www.lileaderbeauty.com