Type Signal

<< Details >>

Defined Constant	Type_Signal
File Type Value	974
Parent Type	SQLite
Carve	Yes
Format Details	Yes
MIME Type	application/x-sqlite3
Filename Extension	db

Signal

Description

Thoughtcrimes Signal Database

Truxton Exploiters

This file type is handled by the following ETLs:

• Expand

Items Produced

Truxton will extract the following from this file type:

• ENTITY_TYPE_PHONE_NUMBER
• Messages
• Type_File_Details
• Type_SQLite_Sample

Details

The tables in this database don't give us a complete list of message participants.

Queries

Here's the queries Truxton uses to exploit Signal databases.

Owner

It is assumed that the owner of the device is record number 1 ([_id] is 1) in the [identities]

SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id]

SMS

The [reply_path_present] column has a value when the [address] is the sender of the message. When it is a null column, the owner is the sender of the message.

SELECT [address],[date],[body],[reply_path_present] FROM [sms]

MMS

The [st] column has a value of 1 when the [address] is the sender of the message.

SELECT
  [mms].[date], 
  [mms].[address],
  [mms].[st],
  [part].[ct],
  [part].[data_size],
  [part].[_data]
FROM [mms]
JOIN [part] ON ([mms].[_id] = [part].[mid])
ORDER BY [mms].[date]