Difference between revisions of "Type Signal"
Jump to navigation
Jump to search
(Created page with "{| style="float:right;border:1px solid black" |+ Details | Defined Constant | <code>Type_Signal</code> |- | File Type Value | 974 |- | Parent Type | Type_SQLite_Database|SQL...") |
|||
| (3 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
{| style="float:right;border:1px solid black" | {| style="float:right;border:1px solid black" | ||
| − | |+ Details | + | |+ [[Type_Diff|<<]] Details [[Type_Icing_MMS_SMS|>>]] |
| Defined Constant | | Defined Constant | ||
| <code>Type_Signal</code> | | <code>Type_Signal</code> | ||
| Line 17: | Line 17: | ||
|- | |- | ||
| MIME Type | | MIME Type | ||
| − | | <code>application/ | + | | <code>application/vnd.sqlite3</code> |
|- | |- | ||
| Filename Extension | | Filename Extension | ||
| Line 27: | Line 27: | ||
=Description= | =Description= | ||
Thoughtcrimes Signal Database | Thoughtcrimes Signal Database | ||
| + | |||
| + | =Truxton Exploiters= | ||
| + | This file type is handled by the following ETLs: | ||
| + | * [[Expand]] | ||
| + | |||
| + | =Items Produced= | ||
| + | Truxton will extract the following from this file type: | ||
| + | * [[Entity Types|ENTITY_TYPE_PHONE_NUMBER]] | ||
| + | * Messages | ||
| + | * [[Type_File_Details]] | ||
| + | * [[Type_SQLite_Sample]] | ||
=Details= | =Details= | ||
| Line 37: | Line 48: | ||
It is assumed that the owner of the device is record number 1 (<code>[_id]</code> is 1) in the <code>[identities]</code> | It is assumed that the owner of the device is record number 1 (<code>[_id]</code> is 1) in the <code>[identities]</code> | ||
| − | < | + | <source lang="sql"> |
SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id] | SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id] | ||
| − | </ | + | </source> |
==SMS== | ==SMS== | ||
| Line 45: | Line 56: | ||
When it is a null column, the owner is the sender of the message. | When it is a null column, the owner is the sender of the message. | ||
| − | < | + | <source lang="sql"> |
SELECT [address],[date],[body],[reply_path_present] FROM [sms] | SELECT [address],[date],[body],[reply_path_present] FROM [sms] | ||
| − | </ | + | </source> |
==MMS== | ==MMS== | ||
The <code>[st]</code> column has a value of 1 when the <code>[address]</code> is the sender of the message. | The <code>[st]</code> column has a value of 1 when the <code>[address]</code> is the sender of the message. | ||
| − | < | + | <source lang="sql"> |
| − | SELECT [mms].[date], | + | SELECT |
| − | [mms].[address], | + | [mms].[date], |
| − | [mms].[st], | + | [mms].[address], |
| − | [part].[ct], | + | [mms].[st], |
| − | [part].[data_size], | + | [part].[ct], |
| − | [part].[_data] | + | [part].[data_size], |
| + | [part].[_data] | ||
FROM [mms] | FROM [mms] | ||
JOIN [part] ON ([mms].[_id] = [part].[mid]) | JOIN [part] ON ([mms].[_id] = [part].[mid]) | ||
ORDER BY [mms].[date] | ORDER BY [mms].[date] | ||
| − | </ | + | </source> |
Latest revision as of 06:04, 8 December 2025
| Defined Constant | Type_Signal
|
| File Type Value | 974 |
| Parent Type | SQLite |
| Carve | Yes |
| Format Details | Yes |
| MIME Type | application/vnd.sqlite3
|
| Filename Extension | db
|
Signal
Contents
Description
Thoughtcrimes Signal Database
Truxton Exploiters
This file type is handled by the following ETLs:
Items Produced
Truxton will extract the following from this file type:
Details
The tables in this database don't give us a complete list of message participants.
Queries
Here's the queries Truxton uses to exploit Signal databases.
Owner
It is assumed that the owner of the device is record number 1 ([_id] is 1) in the [identities]
SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id]
SMS
The [reply_path_present] column has a value when the [address] is the sender of the message.
When it is a null column, the owner is the sender of the message.
SELECT [address],[date],[body],[reply_path_present] FROM [sms]
MMS
The [st] column has a value of 1 when the [address] is the sender of the message.
SELECT
[mms].[date],
[mms].[address],
[mms].[st],
[part].[ct],
[part].[data_size],
[part].[_data]
FROM [mms]
JOIN [part] ON ([mms].[_id] = [part].[mid])
ORDER BY [mms].[date]
