Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.
Awesome Lists | Featured Topics | Projects
https://github.com/kacos2000/queries

SQLite queries
https://github.com/kacos2000/queries
android chrome database dfir dropbox firefox foreniscs forensic googledrive ios mozilla opera queries skype sqlite3 viber whatsup windows-10 windows-11
Last synced: 3 months ago
JSON representation
SQLite queries
Host: GitHub
URL: https://github.com/kacos2000/queries
Owner: kacos2000
License: other
Created: 2018-06-14T08:35:50.000Z (over 6 years ago)
Default Branch: master
Last Pushed: 2023-03-08T19:42:44.000Z (almost 2 years ago)
Last Synced: 2024-05-01T17:43:01.592Z (9 months ago)
Topics: android, chrome, database, dfir, dropbox, firefox, foreniscs, forensic, googledrive, ios, mozilla, opera, queries, skype, sqlite3, viber, whatsup, windows-10, windows-11
Language: PowerShell
Homepage: https://kacos2000.github.io/Queries/
Size: 596 KB
Stars: 68
Watchers: 9
Forks: 13
Open Issues: 0
Metadata Files:
- Readme: README.md
- Funding: .github/FUNDING.yml
- License: LICENSE
Awesome Lists containing this project

README

          ## SQLite queries ##

  -   

      - **Browsers**

        -  Mozilla Firefox *61+*:

            - [firefox_places.sql](https://github.com/kacos2000/queries/blob/master/firefox_places.sql) 

            - [firefox_favicons.sql](https://github.com/kacos2000/queries/blob/master/firefox_favicons.sql) 

            - [firefox_formhistory.sql](https://github.com/kacos2000/queries/blob/master/firefox_formhistory.sql) 

            - [firefox_contentprefs.sql](https://github.com/kacos2000/queries/blob/master/firefox_contentprefs.sql) 

      

        - Opera *54+*

          - [Opera_History.sql](https://github.com/kacos2000/queries/blob/master/Opera_History.sql)

          - [Chrome_favicons.sql](https://github.com/kacos2000/queries/blob/master/chrome_favicons.sql) *(works with Opera as well)*

      

        - Chrome *67+*

          - [Opera_History.sql](https://github.com/kacos2000/queries/blob/master/Opera_History.sql) *(works with Chrome as well)*

          - [Chrome_favicons.sql](https://github.com/kacos2000/queries/blob/master/chrome_favicons.sql)

      

       - **Skype**  *(version 7.21 & 7.41 dBs)*    

       

           - [skype_main.sql](https://github.com/kacos2000/queries/blob/master/skype_main_db.sql)


             Query Skype's *(Classic)* main.db for chats & file transfers.


             

           - [skype_cache_db](https://github.com/kacos2000/queries/blob/master/skype_cache_db.sql)


             Query Skype's *(Classic)* both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\ 


             - 'emo_cache_v2\asyncdb\cache_db'   *(cached Emoticons etc)* & 
 

             - 'media_cache_v3\asyncdb\cache_db' *(Cached Sent & Received images)* folders.


                     

           - [PowerShell script/sqlite query](https://github.com/kacos2000/queries/blob/master/cache_db.ps1) so that you can view the Hex Blob output


             - [Sample Output (csv)](https://github.com/kacos2000/queries/blob/master/cache_db.csv)



      - **Google Drive**   
     

           - Query Google Drive's [snapshot.db](https://github.com/kacos2000/queries/blob/master/GDrive_snapshot.sql) found at the '\AppData\Local\Google\Drive\user@' folder  .


           - Query Google Drive's [cloud_graph.db](https://github.com/kacos2000/queries/blob/master/GDrive_cloudgraph.sql) found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder 



             

      - **Android**   
     

           - [Android 7 Calllog.db (Call history)](https://github.com/kacos2000/queries/blob/master/calllog_db.sql)


           - [Android 7 Contacts2.db (Contacts)](https://github.com/kacos2000/queries/blob/master/contacts2.sql)


           - [Android 9 Contacts2.db (Call history)](https://github.com/kacos2000/queries/blob/master/contacts2calls.sql)


           - [Android logs.db (Samsung Calls/messages)](https://github.com/kacos2000/queries/blob/master/logs_db.sql)



                   

      - **IOS**     
     

           - [IOS 'Accounts3.sqlite' (Accounts)](https://github.com/kacos2000/queries/blob/master/Accounts3_sqlite.sql)


           - [IOS 'calendar.sqlitedb' (Calendar)](https://github.com/kacos2000/queries/blob/master/calendar_sqlitedb.sql)


           - [IOS 'Extras.db' (Calendar)](https://github.com/kacos2000/queries/blob/master/calendar_extras.sql)


           - [IOS 'AddressBook.sqlitedb' (AddressBook)](https://github.com/kacos2000/queries/blob/master/AddressBook_sqlite.sql)


           - [IOS 'AddressBookImages.sqlitedb' (AddressBook Images)](https://github.com/kacos2000/queries/blob/master/AddressBookImages_sqlite.sql)


           - [IOS 11 'Photos.sqlite'](https://github.com/kacos2000/queries/blob/master/Photos_sqlite11.sql)


           - [IOS 7+ 'Photos.sqlite'](https://github.com/kacos2000/queries/blob/master/Photos_sqlite.sql)


           - [IOS 3 'Photos.sqlite'](https://github.com/kacos2000/queries/blob/master/Photos_sqlite3.sql)


           - [IOS 'iPhotoLite.db'](https://github.com/kacos2000/queries/blob/master/iPhotoLitedb.sql)


           - [IOS 'healthdb.sqlite'](https://github.com/kacos2000/queries/blob/master/healthdb.sql)


           - [IOS 'healthdb_secure.sqlite'](https://github.com/kacos2000/queries/blob/master/healthdb_secure.sql)


           - [IOS 'knowledgec.db'](https://github.com/kacos2000/queries/blob/master/knowledgec_db.sql)


           - [IOS 'notes.sqlite'](https://github.com/kacos2000/queries/blob/master/notes_sqlite.sql)


           - [IOS 'Recents' db (Mail)](https://github.com/kacos2000/queries/blob/master/recents.sql)


           - [IOS 'sms.db' (SMS/iMessages)](https://github.com/kacos2000/queries/blob/master/sms_db.sql)


           - [IOS 'callhistory.storedata' (Call history)](https://github.com/kacos2000/queries/blob/master/callhistory_storedata.sql)
 

           - [Hike Sticker Chat (com.bsb.hike)](https://github.com/kacos2000/queries/blob/master/bsb_hike_messagesDB_sqlite.sql)


           - ['contacts.data' (Viber Messages)](https://github.com/kacos2000/queries/blob/master/Viber_Contacts_Data_messages.sql)
 

           - ['ChatStorage.sqlite' (WhatsApp Messages)](https://github.com/kacos2000/queries/blob/master/WhatsApp_Chatstorage_sqlite.sql)
 

 

      - **Windows 10**     
   	 

        - [Samsung Flow App 'Notifications.db'](https://github.com/kacos2000/queries/blob/master/Samsung_Flow_Notifications_db.sql) - *Note:* dB Files are EFS encrypted 


        - [Encapsulation.db](https://github.com/kacos2000/Queries/blob/master/Encapsulationdb.sql) found at 'C:\Windows\appcompat\encapsulation\Encapsulation.db' 
 

      - **Windows 10/11 diagnostics stuff**  

  *from `C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db` '`(*)` ([more info here](https://github.com/rathbuna/EventTranscript.db-Research))*  

        - [ClipboardHistory](https://github.com/kacos2000/Queries/blob/master/ClipboardHistory.Service.sql) 


        - [TaskFlow DataEngine](https://github.com/kacos2000/Queries/blob/master/TaskFlow.sql) 


        - [SoftwareUpdateClientTelemetry](https://github.com/kacos2000/Queries/blob/master/SoftwareUpdateClientTelemetry.sql) 
 

        - [Edge & Apps WebHistory](https://github.com/kacos2000/Queries/blob/master/Microsoft.WebBrowser.sql) 
 

        - [Virtual Desktop](https://github.com/kacos2000/Queries/blob/master/VirtualDesktop.sql) 


        - [YourPhone app](https://github.com/kacos2000/Queries/blob/master/MobilityExperience.YourPhone.sql) 


        - [Windows.Networking](https://github.com/kacos2000/Queries/blob/master/Windows.Networking.sql) 


        - [**NetworkingTriage**](https://github.com/kacos2000/Queries/blob/master/NetworkingTriage.sql)  *(includes info from Windows.Networking)*


        - [**AppInteractivity + AppInteractivitySummary**](https://github.com/kacos2000/Queries/blob/master/AppInteractivity.sql)  *(more info [here](https://www.kroll.com/en/insights/publications/cyber/forensically-unpacking-eventtranscript/forensic-quick-wins-with-eventtranscript))*


        - [Device Census (settings)](https://github.com/kacos2000/Queries/blob/master/Census.sql) 


        - [DxgKrnlTelemetry Client Running Time](https://github.com/kacos2000/Queries/blob/master/ClientRunningTime.sql) 


        - [AppStateChangeSummary](https://github.com/kacos2000/Queries/blob/master/AppStateChangeSummary.sql) 


        - [ProcessLoggingFile & ProcessLoggingRegistry](https://github.com/kacos2000/Queries/blob/master/ProcessLogging.sql) 


        - [FileSystem NTFS,EXFAT,FAT Mount + Volume Info](https://github.com/kacos2000/Queries/blob/master/FileSystem.Mount.sql) 


        - [Microsoft.Windows.Inventory.Core.Install](https://github.com/kacos2000/Queries/blob/master/Inventory.sql) *(installation [state](https://docs.microsoft.com/en-us/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709#microsoftwindowsinventorycoreinventoryapplicationadd) for all hardware and software components).* 


        - [TextInputSessions](https://github.com/kacos2000/Queries/blob/master/Text-InputSession.sql) 


        - [Immersive-Shell](https://github.com/kacos2000/Queries/blob/master/Immersive-Shell.sql) 


        - [User Account Control (UAC)](https://github.com/kacos2000/Queries/blob/master/UAC.sql) *(UAC/LUA ConsentUILaunched)*


        - ----------

        - [List unigue Event Names in the dB](https://github.com/kacos2000/Queries/blob/master/EventTranscript_GetEventNameList.sql) 


        - *Sample event name lists:* 
 

           1. [(csv1 with 3400+)](https://github.com/kacos2000/Queries/blob/master/full_event_names_large.csv) names 
 

           2. [(csv2 with 2800+)](https://github.com/kacos2000/Queries/blob/master/full_event_names.csv) names compiled from 
 

              2a. [Win10 csv](https://github.com/kacos2000/Queries/blob/master/full_event_names1.csv) & 
 

              2b. [Win11 csv (VM)](https://github.com/kacos2000/Queries/blob/master/full_event_names2.csv) 


        - *[Event Tracing GUID + Provider name list](https://github.com/kacos2000/Queries/blob/master/providers.txt)*  
 

        - *(Related event log: 'Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx')*

        - ----------

        

`(*)` Adjust settings:

`HKLM: SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\EventTranscriptKey`

   - DWORD `EnableEventTranscript` *(0: disabled, 1: enabled)*

   - DWORD `HoursOfHistoryToKeep` *(in hours)*

   - DWORD `MaxStoreSize` *(nr of bytes)*

   - DWORD `RequestedMaxStoreSize` *(nr of bytes, same as above)*

   



      - **Windows 11 Search data** *(new 22H2+ SQLite3 dBs)*


        *found at 'C:\ProgramData\Microsoft\Search\Data\Applications\Windows'*


        - [PropertyMap](https://github.com/kacos2000/Queries/blob/master/Win_Search_PropertyMap.sql)

        - [Paths (SystemIndex_1_PropertyStore) query](https://github.com/kacos2000/Queries/blob/master/Win_Search_PropertyStore.sql)

        - [SecurityDescriptor (SecStore.db) query](https://github.com/kacos2000/Queries/blob/master/Win_Search_SecStore.sql)

        - [Paths/Files & Timestamps (Windows-gather.db)](https://github.com/kacos2000/Queries/blob/master/Win_Search_gatherdB.sql)