Possible logs entries may include the user’s client requesting a snapshot for contact/message collection or queuing. This table displays application data for the user account such as the last time the application ‘refreshed’ its different data. Of the 29 tables within this database, only three are of relevance to us. The majority of the data you will retrieve from this database is focused around user account logs and app details. These are fbomnistore.db, orca2.db, p2p_transfer.db, and searchstore.db. Along my careful search I found only four database files that have the ability to indirectly serve as possible case evidence. Although some sqlite database files do exist on Windows, they greatly differed from those on the mobile version. I went into this Windows app overview thinking I would find databases somewhat similar to those present on mobile devices. To my surprise, this application uses a beautiful blend of both local and cloud storage. What data is stored in Facebook Messenger from the Windows 10 App Store? Unfortunately, Facebook Messenger is not as friendly on the Windows 10 OS. Contacts, message conversations, timestamps, etc are all ripe for the investigator’s picking. Numerous tables exist within this local database (as of July 2018) that contain mountains of user data. The app reached a billion users in 2017 and has been steadily increasing ever since (forbes).Ī typical smartphone device contains the ‘’ database, which is codename for the messenger project. For those of you unfamiliar, Facebook decided to better handle their traffic by creating the standalone “Messenger” application for all non-browser direct messages. If you have ever performed mobile forensics, chances are you’ve come across Facebook’s Messenger app.

Messenger for windows