Queries/README.md

• SQLite queries

  • Browsers

    • Mozilla Firefox 61+:

      • firefox_places.sql
      • firefox_favicons.sql
      • firefox_formhistory.sql
      • firefox_contentprefs.sql

    • Opera 54+

      • Opera_History.sql
      • Chrome_favicons.sql (works with Opera as well)

    • Chrome 67+

      • Opera_History.sql (works with Chrome as well)
      • Chrome_favicons.sql

  • Skype (version 7.21 & 7.41 dBs)

    • skype_main.sql
      Query Skype's (Classic) main.db for chats & file transfers.
      

    • skype_cache_db
      Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\
      

      • 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc) &
        
      • 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
        

    • PowerShell script/sqlite query so that you can view the Hex Blob output
      

      • Sample Output (csv)
        
        

  • Google Drive
    
    - Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\user@' folder .
    - Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder

  • Android
    
    - Android 7 Calllog.db (Call history)
    - Android 7 Contacts2.db (Contacts)
    - Android 9 Contacts2.db (Call history)
    

  • IOS
    
    - IOS 'Photos.db'
    - IOS 'iPhotoLite.db'
    - IOS 'healthdb.sqlite'
    - IOS 'healthdb_secure.sqlite'
    - IOS 'notes.sqlite'
    - IOS 'sms.db' (SMS/iMessages
    - IOS 'callhistory.storedata' (Call history)