GitHub

SQLite queries

- Browsers
  - Mozilla Firefox 61+:
  - Opera 54+
    - Opera_History.sql
    - Chrome_favicons.sql (works with Opera as well)
  - Chrome 67+
    - Opera_History.sql (works with Chrome as well)
    - Chrome_favicons.sql
- Skype (version 7.21 & 7.41 dBs)
  - skype_main.sql
    Query Skype's (Classic) main.db for chats & file transfers.
  - skype_cache_db
    Query Skype's (Classic) both cache_db.db databases found at AppData\Roaming\UserProfile\media_messaging\
    - 'emo_cache_v2\asyncdb\cache_db' (cached Emoticons etc) &
    - 'media_cache_v3\asyncdb\cache_db' (Cached Sent & Received images) folders.
  - PowerShell script/sqlite query so that you can view the Hex Blob output
    - Sample Output (csv)
- Google Drive
  - Query Google Drive's snapshot.db found at the '\AppData\Local\Google\Drive\user@' folder .
  - Query Google Drive's cloud_graph.db found at the '\AppData\Local\Google\Drive\user@\cloud_graph' folder
- Android
- IOS
- Windows 10
  - Samsung Flow App 'Notifications.db' - Note: dB Files are EFS encrypted
  - Encapsulation.db found at 'C:\Windows\appcompat\encapsulation\Encapsulation.db'
- Windows 10/11 diagnostics stuff
  from C:\ProgramData\Microsoft\Diagnosis\EventTranscript\EventTranscript.db '(*) (more info here)
  - ClipboardHistory
  - TaskFlow DataEngine
  - SoftwareUpdateClientTelemetry
  - Edge & Apps WebHistory
  - Virtual Desktop
  - YourPhone app
  - Windows.Networking
  - NetworkingTriage (includes info from Windows.Networking)
  - AppInteractivity + AppInteractivitySummary (more info here)
  - Device Census (settings)
  - DxgKrnlTelemetry Client Running Time
  - AppStateChangeSummary
  - ProcessLoggingFile & ProcessLoggingRegistry
  - FileSystem NTFS,EXFAT,FAT Mount + Volume Info
  - Microsoft.Windows.Inventory.Core.Install (installation state for all hardware and software components).
  - TextInputSessions
  - Immersive-Shell
  - User Account Control (UAC) (UAC/LUA ConsentUILaunched)
  - List unigue Event Names in the dB
  - Sample event name lists:
    1. (csv1 with 3400+) names
    2. (csv2 with 2800+) names compiled from
      2a. Win10 csv &
      2b. Win11 csv (VM)
  - Event Tracing GUID + Provider name list
  - (Related event log: 'Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx')

(*) Adjust settings: HKLM: SOFTWARE\Microsoft\Windows\CurrentVersion\Diagnostics\DiagTrack\EventTranscriptKey

DWORD EnableEventTranscript (0: disabled, 1: enabled)
DWORD HoursOfHistoryToKeep (in hours)
DWORD MaxStoreSize (nr of bytes)
DWORD RequestedMaxStoreSize (nr of bytes, same as above)
- Windows 11 Search data (new 22H2+ SQLite3 dBs)
  found at 'C:\ProgramData\Microsoft\Search\Data\Applications\Windows'

Name		Name	Last commit message	Last commit date
Latest commit History 246 Commits
.github		.github
Accounts3_sqlite.sql		Accounts3_sqlite.sql
AddressBookImages_sqlite.sql		AddressBookImages_sqlite.sql
AddressBook_sqlite.sql		AddressBook_sqlite.sql
AppInteractivity.sql		AppInteractivity.sql
AppStateChangeSummary.sql		AppStateChangeSummary.sql
Calls.xml		Calls.xml
Census.sql		Census.sql
ClientRunningTime.sql		ClientRunningTime.sql
ClipboardHistory.Service.sql		ClipboardHistory.Service.sql
Encapsulationdb.sql		Encapsulationdb.sql
EventTranscript_GetEventNameList.sql		EventTranscript_GetEventNameList.sql
FileSystem.Mount.sql		FileSystem.Mount.sql
GDrive_cloudgraph.sql		GDrive_cloudgraph.sql
GDrive_snapshot.sql		GDrive_snapshot.sql
GoogleDrive.xml		GoogleDrive.xml
Immersive-Shell.sql		Immersive-Shell.sql
Inventory.sql		Inventory.sql
LICENSE		LICENSE
Microsoft.WebBrowser.sql		Microsoft.WebBrowser.sql
MobilityExperience.YourPhone.sql		MobilityExperience.YourPhone.sql
NetworkingTriage.sql		NetworkingTriage.sql
Opera_History.sql		Opera_History.sql
Photos.xml		Photos.xml
Photos_sqlite.sql		Photos_sqlite.sql
Photos_sqlite11.sql		Photos_sqlite11.sql
Photos_sqlite3.sql		Photos_sqlite3.sql
ProcessLogging.sql		ProcessLogging.sql
README.md		README.md
Samsung_Flow_Notifications_db.sql		Samsung_Flow_Notifications_db.sql
SoftwareUpdateClientTelemetry.sql		SoftwareUpdateClientTelemetry.sql
TaskFlow.sql		TaskFlow.sql
TeraCopy_Windows.sql		TeraCopy_Windows.sql
TeraCopy_Windows.xml		TeraCopy_Windows.xml
Text-InputSession.sql		Text-InputSession.sql
UAC.sql		UAC.sql
Viber_Contacts_Data_messages.sql		Viber_Contacts_Data_messages.sql
VirtualDesktop.sql		VirtualDesktop.sql
WhatsApp_Chatstorage_sqlite.sql		WhatsApp_Chatstorage_sqlite.sql
Win_Search_PropertyMap.sql		Win_Search_PropertyMap.sql
Win_Search_PropertyStore.sql		Win_Search_PropertyStore.sql
Win_Search_SecStore.sql		Win_Search_SecStore.sql
Win_Search_gatherdB.sql		Win_Search_gatherdB.sql
Windows.Networking.sql		Windows.Networking.sql
_config.yml		_config.yml
bsb_hike_messagesDB_sqlite.sql		bsb_hike_messagesDB_sqlite.sql
cache_db.csv		cache_db.csv
cache_db.ps1		cache_db.ps1
calendar_extras.sql		calendar_extras.sql
calendar_sqlitedb.sql		calendar_sqlitedb.sql
callhistory_storedata.sql		callhistory_storedata.sql
calllog_db.sql		calllog_db.sql
chrome_favicons.sql		chrome_favicons.sql
contacts2.sql		contacts2.sql
contacts2calls.sql		contacts2calls.sql
firefox_contentprefs.sql		firefox_contentprefs.sql
firefox_favicons.sql		firefox_favicons.sql
firefox_formhistory.sql		firefox_formhistory.sql
firefox_places.sql		firefox_places.sql
full_event_names.csv		full_event_names.csv
full_event_names1.csv		full_event_names1.csv
full_event_names2.csv		full_event_names2.csv
full_event_names_large.csv		full_event_names_large.csv
healthdb.sql		healthdb.sql
healthdb_secure.sql		healthdb_secure.sql
healthdb_secure.xml		healthdb_secure.xml
iPhotoLitedb.sql		iPhotoLitedb.sql
knowledgec_db.sql		knowledgec_db.sql
logs_db.sql		logs_db.sql
logs_db.xml		logs_db.xml
notes_sqlite.sql		notes_sqlite.sql
providers.txt		providers.txt
recents.sql		recents.sql
skype_cache_db.sql		skype_cache_db.sql
skype_main_db.sql		skype_main_db.sql
sms_db.sql		sms_db.sql

License

kacos2000/Queries

Folders and files

Latest commit

History