Type Signal - Revision history

Sam at 10:04, 8 December 2025

2025-12-08T10:04:31Z

Sam at 21:36, 21 May 2024

2024-05-21T21:36:02Z

Sam at 12:07, 10 March 2024

2024-03-10T12:07:21Z

Sam at 15:28, 2 February 2021

2021-02-02T15:28:08Z

Sam: Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | `Type_Signal` |- | File Type Value | 974 |- | Parent Type | Type_SQLite_Database|SQL..."

2020-05-19T08:04:59Z

Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Signal</code> |- | File Type Value | 974 |- | Parent Type | Type_SQLite_Database|SQL..."

New page

{| style="float:right;border:1px solid black"
|+ Details
| Defined Constant
| <code>Type_Signal</code>
|-
| File Type Value
| 974
|-
| Parent Type
| [[Type_SQLite_Database|SQLite]]
|-
| Carve
| Yes
|-
| Format Details
| Yes
|-
| MIME Type
| <code>application/x-sqlite3</code>
|-
| Filename Extension
| <code>db</code>
|}

Signal

=Description=
Thoughtcrimes Signal Database

=Details=
The tables in this database don't give us a complete list of message participants.

=Queries=
Here's the queries Truxton uses to exploit Signal databases.

==Owner==
It is assumed that the owner of the device is record number 1 (<code>[_id]</code> is 1) in the <code>[identities]</code>

<syntaxhighlight lang="sql">
SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id]
</syntaxhighlight>

==SMS==
The <code>[reply_path_present]</code> column has a value when the <code>[address]</code> is the sender of the message.
When it is a null column, the owner is the sender of the message.

<syntaxhighlight lang="sql">
SELECT [address],[date],[body],[reply_path_present] FROM [sms]
</syntaxhighlight>

==MMS==
The <code>[st]</code> column has a value of 1 when the <code>[address]</code> is the sender of the message.

<syntaxhighlight lang="sql">
SELECT [mms].[date],
[mms].[address],
[mms].[st],
[part].[ct],
[part].[data_size],
[part].[_data]
FROM [mms]
JOIN [part] ON ([mms].[_id] = [part].[mid])
ORDER BY [mms].[date]
</syntaxhighlight>

@@ Line 17: / Line 17: @@
 |-
 | MIME Type
-| <code>application/x-sqlite3</code>
+| <code>application/vnd.sqlite3</code>
 |-
 | Filename Extension

@@ Line 1: / Line 1: @@
 {| style="float:right;border:1px solid black"
-|+ Details
+|+ [[Type_Diff|<<]] Details [[Type_Icing_MMS_SMS|>>]]
 | Defined Constant
 | <code>Type_Signal</code>

@@ Line 27: / Line 27: @@
 =Description=
 Thoughtcrimes Signal Database
 =Details=
@@ Line 64: / Line 75: @@
 ORDER BY [mms].[date]
 </source>