Thunderbird forensic

De Linuxmemo.

(Différences entre les versions)
(global-messages.db.sqlite)
(global-messages.db.sqlite)
Ligne 8 : Ligne 8 :
  SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%';
  SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%';
  SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%';
  SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%';
 +
body of the message
 +
SELECT DISTINCT docid, c1subject, c2attachmentNames, c0body FROM messagesText_content WHERE c3author LIKE '%amazon%' AND docid=2314;
 +
attachments
 +
SELECT DISTINCT docid, c1subject, c2attachmentNames FROM messagesText_content WHERE c3author LIKE '%amazon%' AND c2attachmentNames <> '';

Version du 7 janvier 2021 à 12:47

global-messages.db.sqlite

contacts, identities

SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id;
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE '%bank%';
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE 'BEA';

messages, messagesText_content

SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%';
SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%';

body of the message

SELECT DISTINCT docid, c1subject, c2attachmentNames, c0body FROM messagesText_content WHERE c3author LIKE '%amazon%' AND docid=2314;

attachments

SELECT DISTINCT docid, c1subject, c2attachmentNames FROM messagesText_content WHERE c3author LIKE '%amazon%' AND c2attachmentNames <> ;
Outils personnels