Queries/README.md

SQLite queries

• • Browsers

    • Mozilla Firefox 61+:

      • firefox_places.sql
      • firefox_favicons.sql
      • firefox_formhistory.sql
      • firefox_contentprefs.sql

    • Opera 54+

      • Opera_History.sql
      • Chrome_favicons.sql (works with Opera as well)

    • Chrome 67+

      • Opera_History.sql (works with Chrome as well)
      • Chrome_favicons.sql

  • Skype (version 7.21 & 7.41 dBs)

    • skype_main.sql
      Query Skype's (Classic) main.db for chats & file transfers.
      

    • skype_cache_db
      Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\
      

      • 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc) &
        
      • 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
        

    • PowerShell script/sqlite query so that you can view the Hex Blob output
      

      • Sample Output (csv)
        
        

  • Google Drive
    

    • Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\user@' folder .
      
    • Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder
      
      

  • Android
    

    • Android 7 Calllog.db (Call history)
      
    • Android 7 Contacts2.db (Contacts)
      
    • Android 9 Contacts2.db (Call history)
      
    • Android logs.db (Samsung Calls/messages)
      
      

  • IOS
    

    • IOS 'Accounts3.sqlite' (Accounts)
      
    • IOS 'calendar.sqlitedb' (Calendar)
      
    • IOS 'Extras.db' (Calendar)
      
    • IOS 'AddressBook.sqlitedb' (AddressBook)
      
    • IOS 'AddressBookImages.sqlitedb' (AddressBook Images)
      
    • IOS 11 'Photos.sqlite'
      
    • IOS 7+ 'Photos.sqlite'
      
    • IOS 3 'Photos.sqlite'
      
    • IOS 'iPhotoLite.db'
      
    • IOS 'healthdb.sqlite'
      
    • IOS 'healthdb_secure.sqlite'
      
    • IOS 'knowledgec.db'
      
    • IOS 'notes.sqlite'
      
    • IOS 'Recents' db (Mail)
      
    • IOS 'sms.db' (SMS/iMessages)
      
    • IOS 'callhistory.storedata' (Call history)
      
    • Hike Sticker Chat (com.bsb.hike)
      
    • 'contacts.data' (Viber Messages)
      
    • 'ChatStorage.sqlite' (WhatsApp Messages)
      

  • Windows 10
    - Samsung Flow App 'Notifications.db' - Note: dB Files are EFS encrypted
    

    • Encapsulation.db found at 'C:\Windows\appcompat\encapsulation\Encapsulation.db'
      

  • Windows 10 diagnostics stuff
    from 'C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db' (more info here)
    - List unigue Event Names in the dB
    - ClipboardHistory
    - SoftwareUpdateClientTelemetry
    - Edge & Apps WebHistory
    - Virtual Desktop
    - YourPhone app
    - Windows.Networking
    - NetworkingTriage (includes info from Windows.Networking)
    - AppInteractivity + AppInteractivitySummary (more info here)
    - Device Census (settings)
    - DxgKrnlTelemetry Client Running Time
    - ProcessLoggingFile & ProcessLoggingRegistry