Skype forensics with Belkasoft Evidence Center

On modern Windows systems Skype is installed by default, so it's very important for a forensic examiner to extract user data from this application. This can be calls, messages, transferred or received files, and so on. In this recipe, we will show you how to parse these valuable artifacts with Belkasoft Evidence Center.

Getting ready

First of all, you should get a Skype profile folder. Again, you can use a forensic image, but to save time for testing purposes, we recommend using a profile folder as the data source. You can find Skype profile folders (yes, there can be more than one folder, as multiple accounts can be used on the same device) here:

C:\Users\%USERNAME%\AppData...