Skype forensics with Belkasoft Evidence Center
On modern Windows systems Skype is installed by default, so it's very important for a forensic examiner to extract user data from this application. This can be calls, messages, transferred or received files, and so on. In this recipe, we will show you how to parse these valuable artifacts with Belkasoft Evidence Center.
Getting ready
First of all, you should get a Skype profile folder. Again, you can use a forensic image, but to save time for testing purposes, we recommend using a profile folder as the data source. You can find Skype profile folders (yes, there can be more than one folder, as multiple accounts can be used on the same device) here:
C:\Users\%USERNAME%\AppData\Roaming\Skype\
Once you get it, make sure Belkasoft Evidence Center (valid licence or trial) is installed on your workstation, and we are ready to start.
How to do it...
We can start the process by following the given steps:
- Create a new case and add the profile folder you previously...
