Bebo Chat

Messages sent or received in Bebo® live chat. Information found within these fragments can include the status of the message, the date/time, the sender username, target username, and the message itself.



Facebook® related web pages, including but not limited to the Inbox page, emails, photo galleries, groups, and so on. Most recovered items will be fragments and not the complete page, but attempts are made to recover the entire page and filter out false positives. A header is added to the fragment to aid in viewing the page in its original format.


Facebook Status Updates and Wall Posts

This search will recover Facebook® Status Updates and Wall Posts. These can be from the local user or from other users on Facebook. Recovered items can include the User ID and Name of the person making the status update or wall post, and the text of the update/post itself. This artifact does not contain the date/time that the update or post was made.


Facebook Chat Messages

Messages sent and received using the Facebook® live chat feature. Information found with the message can include the Facebook® profile ID used to send/receive the message, the from/to names and ID’s, and the date/time (in UTC) that the message was sent. However, there are a few different formats of Facebook chat and not all formats include all this data.


Facebook Emails

This search will recover emails sent or received on Facebook®. Recovered items can include the Logged In User ID (the ID of the person logged in to Facebook when the email was sent/received), the subject of the email, the recipients of the email, the Last Updated Time (last time a message in the thread was added), the Original Author, the Thread ID#, the Time Rendered (local time), the Author’s User ID and Name, whether or not it was sent from a mobile device, any attachments, and the message.


Facebook Email Snippets

This search will recover Facebook® email “snippets” (previews of a full email message). This artifact is left behind when a user is viewing their Inbox or Sent Messages folder in their Facebook® account. It can include the Subject line, Original Author user ID, Recent Authors user IDs (the participants of the email conversation), Time Last Updated (the last time a message was posted in the thread), thread ID (ID# of the message in the user’s mailbox), and the “snippet” itself.


Facebook Photos

This search looks for files that follow a Facebook photo file naming convention and recovers them, indicating which Facebook user ID the photo belongs to. At this time, only files found in the Internet Explorer cache folders are supported/recovered.



This search will carve and parse Google+ live chat. This is the chat that can occur between users while logged into the Google+ social networking website. Information recovered includes whether the message was sent or received, the email address of the sender/recipient, the date/time, and the text of the message.



This search will locate and carve emails that have been sent or received on LinkedIn. These email fragments can include the from/to names, subject, date/time, and full message. Please note that, depending on the browser, these emails will be in a compressed gzipped form which the software decompresses on-the-fly.


Myspace Chat

Messages sent or received in MySpace® live chat. Information found within these fragments can include the status of the message, the date/time, the sender ID, target ID, and the message itself. Some user info is also recoverable, such as the real name/username associated to a MySpace ID, image URL, and other information. This information is saved to a ‘User Info’ report.



This search will recover Twitter® status updates. This artifact is left behind in several formats when a user is updating their status or viewing another person’s status update. It can include the Name of the user, the screen name, created time, status ID#, where the status was updated from, geo-tags, if the update is a “retweet”, the profile image URL of the user, and the text of the status update.