Jun 152012
 

Find artifacs by looking for:

“msg”:{“text”:          AND     from_name      (do it by a “live search” with FTK 4.X)

You will find a file with this piece of text:

{“t”:”msg”,”c”:”p_100000XXXXXX“,”s”:405,”ms”:[{“id”:100000XXX189519,”window_id”:XXX6112368,”type”:”focus_chat”}]}for (;;);{“t”:”msg”,”c”:”p_100000XXXXXX“,”s”:404,”ms”:[{“msg”:{“text”:”CHE TEMPO FA OGGI?“,”time”:13057407XXXXX,”clientTime”:13057407XXXXX,”msgID”:”143312XXXX“},”from”:105521XXXX,

“to”:100000XXXXXX,”from_name”:”LITIOS PICCI“,”from_first_name”:”LITIOS“,”from_gender”:2,”fl”:1,
“to_name”:”LUIGIS RANZI,”to_first_name”:”LUIGIS“,”to_gender”:2,”type”:”msg”}]}

 

.

PROFILE_ID: p_100000XXXXXX (PERSONAL PROFILE, UNIQUE ID)
MESSAGE_ID: 143312XXXX
SENDER_ID: 105521XXXX (FOR ANTI-SPAMMING, UNIQUE ID)
TIME + DATE (EPOCH): 13057407XXXXX
SENDER: LITIOS
RECEIVER: LUIGIS
Message: CHE TEMPO FA OGGI?

——————————————————————————————–

UPDATE 21/06/2012

If you meet this file (maybe from an IPHONE device): http_m.facebook.com_0.localstorage  you must open it with SQLite Browser and find the value of the KEY “pgcontent:/story.php?story_fbid…..”

You will find “WEB ARTIFACS” about FACEBOOK FRIENDS.

What are “localstorage”???

Look: here.

 Leave a Reply

(required)

(required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>