Thunderbird forensic

De Linuxmemo.

global-messages.db.sqlite

contacts, identities

SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id;
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE '%bank%';
SELECT contacts.name, identities.value FROM contacts, identities WHERE contacts.id=identities.id AND contacts.name LIKE 'BEA';

messages, messagesText_content

SELECT DISTINCT docid, c1subject, c3author FROM messagesText_content WHERE c3author LIKE '%amazon%';
SELECT DISTINCT docid, c1subject, c4recipients FROM messagesText_content WHERE c4recipients LIKE '%amazon%';