Thunderbird forensic
De Linuxmemo.
(Différences entre les versions)
(→global-messages.db.sqlite) |
(→global-messages.db.sqlite) |
||
| Ligne 1 : | Ligne 1 : | ||
[[Catégorie:Forensic]] | [[Catégorie:Forensic]] | ||
==global-messages.db.sqlite== | ==global-messages.db.sqlite== | ||
| + | contacts, identities | ||
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id; | SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id; | ||
| - | |||
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE '%bank%'; | SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE '%bank%'; | ||
| - | |||
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE 'BEA'; | SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE 'BEA'; | ||
| + | messages, messagesText_content | ||
| + | SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%'; | ||
| + | SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%'; | ||
Version du 7 janvier 2021 à 12:46
global-messages.db.sqlite
contacts, identities
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id; SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE '%bank%'; SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE 'BEA';
messages, messagesText_content
SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%'; SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%';
