Browsers
- Mozilla Firefox 61+ :
- Opera 54+
- Opera_History.sql
- Chrome_favicons.sql (works with Opera as well)
- Chrome 67+
- Opera_History.sql (works with Chrome as well)
- Chrome_favicons.sql
Skype (version 7.21 & 7.41 dBs)
- skype_main.sql
Query Skype's (Classic) main.db for chats & file transfers. - skype_cache_db
Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\- 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc) &
- 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
- PowerShell script/sqlite query so that you can view the Hex Blob output
Google Drive
- Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\[email protected]' folder .
- Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\[email protected]\cloud_graph' folder
Android
- Android 7 Calllog.db (Call history)
- Android 7 Contacts2.db (Contacts)
- Android 9 Contacts2.db (Call history)
- Android logs.db (Samsung Calls/messages)
IOS
- IOS 'Accounts3.sqlite' (Accounts)
- IOS 'calendar.sqlitedb' (Calendar)
- IOS 'Extras.db' (Calendar)
- IOS 'AddressBook.sqlitedb' (AddressBook)
- IOS 'AddressBookImages.sqlitedb' (AddressBook Images)
- IOS 11 'Photos.sqlite'
- IOS 7+ 'Photos.sqlite'
- IOS 3 'Photos.sqlite'
- IOS 'iPhotoLite.db'
- IOS 'healthdb.sqlite'
- IOS 'healthdb_secure.sqlite'
- IOS 'knowledgec.db'
- IOS 'notes.sqlite'
- IOS 'Recents' db (Mail)
- IOS 'sms.db' (SMS/iMessages)
- IOS 'callhistory.storedata' (Call history)
- Hike Sticker Chat (com.bsb.hike)
- 'contacts.data' (Viber Messages)
- 'ChatStorage.sqlite' (WhatsApp Messages)
Windows 10 Apps
- Samsung Flow App 'Notifications.db' - Note: dB Files are EFS encrypted
