This is an Autopsy Plugin used to parse SQLite Databases generated by the Facebook App on Windows 10 platforms.
To run:
- Open Autopsy and determine the location of your python modules on your local machine.
- Create a separate folder for this parser.
- Add this parser to that folder.
- Add your "fbsyncstore.db" file to that same directory. Make sure your file name matches what is in the code.
- Create a new case in autopsy and add the above data source.
- Choose to run this module.
*Note: Run times may vary depending on how many rows there are to query in the persons table.