Comments on Computer Forensics, Malware Analysis & Digital Investigations: EnScript to decode Yahoo chats in unallocated

Update on the above comment. The script does work...

2009-10-27T20:03:25.276-07:00

Update on the above comment. The script does work on my keyword search hits, with a few issues. During one process there were roughly 30 chat fragments all in a row, but the script would not complete. I shut it down, and the console did show all of the results. In another instance the script gave me an error (I can't recall the wording right now), but it also returned the results in the console window. All in all the script has worked for me. I'm just not sure about the minor issues.

mj

Lance, I didn't have a specific keyword to us...

2009-10-27T13:31:00.125-07:00

Lance,

I didn't have a specific keyword to use on your first Yahoo enscript, so here is what I did. I did a keyword search for:

\x47|\x48|\x49|\x4a|\x4b\x06\x00{3,3}\x00|\x01\x00{3,3}[^\x00]\x00{3,3}

I immediately found hits in unallocated that obviously denote a chat of about 15 back and forth texts. I placed my cursor on the first Unix time character and ran your script. It's been running for 10 minutes now, which seems a bit long since the chat was not that large.

Will this keyword search work with your second script?

Mark

Lance, thanks for the time and effort you provide ...

2009-10-25T10:00:33.032-07:00

Lance, thanks for the time and effort you provide in developing these EnScripts. They are very much appreciated.

mark