Investigating Messenger Plus!
12/01/2021 Tuesday
Messenger Plus! is an add-on for Windows Live Messenger and Skype. It was released in May 2001 and provides instant messaging, custom status tags, event and chat logging, auto replies, and the user’s contacts statistics. Messenger Plus! can be used in laptops, mobile devices, tablets and it is available for Windows operating systems.
Digital Forensics Value of Messenger Plus! Artifacts
In Messenger Plus!, artifacts display information about the user account and configuration. From a forensic perspective, it can provide us with a lot of resources that can be used as critical evidence. Suspects, on the other hand, have the ability to delete information by wiping conversation archives or physically destroying Messenger Plus! logs. Tracking such information is critical during the digital forensic analysis process.
Location of Messenger Plus! Artifacts
In Windows 10 Messenger Plus! artifacts are located at C:\Program Files\Messenger Plus! Live
Structure of Messenger Plus! Artifacts
Messenger Plus! consists of .edb files which are databases that store backups, log files, and logs.
Analyzing Messenger Plus! Artifacts with ArtiFast Windows
This section will discuss how to use ArtiFast Windows to analyze Messenger Plus! artifact from Windows machines and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Messenger Plus! artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Messenger Plus! artifacts in ArtiFast software.
Messenger Plus! Artifact
- User Name - Account username.
- Message Body - The message body.
- Message Author - The message sender.
- Message Date - Date and time when the message was created.
