Daily Blog #317: New sources for skype chat logs

New sources for skype chat logs by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
             For those of you who are Skype users you know that Microsoft has begun the process of integrating Skype into their ecosystem for quite some time. Part of that process was asking users to link their Skype account to a "Microsoft account". This itself may not seem very important but the implications are. What I've found in my own testing is that once a Skype account is connected to a Microsoft Account is that the Skype chat messages sent and received are separately being cached there, for the convenience of the user of course. This integrates into the old messaging application built into what was Live and is now Outlook.com for Microsoft Messenger.

So what does this mean for your analysis?

It means that even if the user has his Skype chat history turned off, as I did in my testing, the chat logs are still being saved to the Microsoft account's messaging history. I could find no way to clear the chat history that was being stored or any method of turning off the feature. In fact I found the only way to remove the chat history was to unlink the Skype account from the Microsoft account in its entirety.

So if you are looking at a system that has Skype installed and they are logging in with a Microsoft account there may be a lot of previously thought nonexistent chat logs waiting for you. Now the question is, how to retrieve them! I'll look into that after the remote access credential exposure series.

Good luck!

Post a Comment