Queries/README.md

SQLite queries

• • Browsers

    • Mozilla Firefox 61+:

      • firefox_places.sql
      • firefox_favicons.sql
      • firefox_formhistory.sql
      • firefox_contentprefs.sql

    • Opera 54+

      • Opera_History.sql
      • Chrome_favicons.sql (works with Opera as well)

    • Chrome 67+

      • Opera_History.sql (works with Chrome as well)
      • Chrome_favicons.sql

  • Skype (version 7.21 & 7.41 dBs)

    • skype_main.sql
      Query Skype's (Classic) main.db for chats & file transfers.
      

    • skype_cache_db
      Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\
      

      • 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc) &
        
      • 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
        

    • PowerShell script/sqlite query so that you can view the Hex Blob output
      

      • Sample Output (csv)
        
        

  • Google Drive
    

    • Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\user@' folder .
      - Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder
      
      

  • Android
    
    - Android 7 Calllog.db (Call history)
    - Android 7 Contacts2.db (Contacts)
    - Android 9 Contacts2.db (Call history)
    - Android logs.db (Samsung Calls/messages)
    
    

  • IOS
    
    - IOS 'Accounts3.sqlite' (Accounts)
    - IOS 'calendar.sqlitedb' (Calendar)
    - IOS 'Extras.db' (Calendar)
    - IOS 'AddressBook.sqlitedb' (AddressBook)
    - IOS 'AddressBookImages.sqlitedb' (AddressBook Images)
    - IOS 11 'Photos.sqlite'
    - IOS 7+ 'Photos.sqlite'
    - IOS 3 'Photos.sqlite'
    - IOS 'iPhotoLite.db'
    - IOS 'healthdb.sqlite'
    - IOS 'healthdb_secure.sqlite'
    - IOS 'knowledgec.db'
    - IOS 'notes.sqlite'
    - IOS 'Recents' db (Mail)
    - IOS 'sms.db' (SMS/iMessages)
    - IOS 'callhistory.storedata' (Call history)
    - Hike Sticker Chat (com.bsb.hike)
    - 'contacts.data' (Viber Messages)
    - 'ChatStorage.sqlite' (WhatsApp Messages)
    

  • Windows 10
    - Samsung Flow App 'Notifications.db' - Note: dB Files are EFS encrypted
    - Encapsulation.db found at 'C:\Windows\appcompat\encapsulation\Encapsulation.db'
    

  • Windows 10/11 diagnostics stuff
    from C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db '(*) (more info here)

    • ClipboardHistory
      
    • SoftwareUpdateClientTelemetry
      
    • Edge & Apps WebHistory
      
    • Virtual Desktop
      
    • YourPhone app
      
    • Windows.Networking
      
    • NetworkingTriage (includes info from Windows.Networking)
      
    • AppInteractivity + AppInteractivitySummary (more info here)
      
    • Device Census (settings)
      
    • DxgKrnlTelemetry Client Running Time
      
    • AppStateChangeSummary
      
    • ProcessLoggingFile & ProcessLoggingRegistry
      
    • FileSystem NTFS,EXFAT,FAT Mount + Volume Info
      
    • Microsoft.Windows.Inventory.Core.Install (installation state for all hardware and software components).
      
    • TextInputSessions
      

    ---

    • List unigue Event Names in the dB
      
    • Sample event name lists:
      
      1. (csv1 with 3400+) names
         
      2. (csv2 with 2800+) names compiled from
         2a. Win10 csv &
         2b. Win11 csv (VM)
         

(*) Adjust settings: HKLM: SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\EventTranscriptKey

• DWORD EnableEventTranscript (0: disabled, 1: enabled)
• DWORD HoursOfHistoryToKeep (in hours)
• DWORD MaxStoreSize (nr of bytes)
• DWORD RequestedMaxStoreSize (nr of bytes, same as above)