Type Signal
Jump to navigation
Jump to search
| Defined Constant | Type_Signal
|
| File Type Value | 974 |
| Parent Type | SQLite |
| Carve | Yes |
| Format Details | Yes |
| MIME Type | application/x-sqlite3
|
| Filename Extension | db
|
Signal
Description
Thoughtcrimes Signal Database
Details
The tables in this database don't give us a complete list of message participants.
Queries
Here's the queries Truxton uses to exploit Signal databases.
Owner
It is assumed that the owner of the device is record number 1 ([_id] is 1) in the [identities]
SELECT [_id],[address],[timestamp] FROM [identities] ORDER BY [_id]
SMS
The [reply_path_present] column has a value when the [address] is the sender of the message.
When it is a null column, the owner is the sender of the message.
SELECT [address],[date],[body],[reply_path_present] FROM [sms]
MMS
The [st] column has a value of 1 when the [address] is the sender of the message.
SELECT [mms].[date],
[mms].[address],
[mms].[st],
[part].[ct],
[part].[data_size],
[part].[_data]
FROM [mms]
JOIN [part] ON ([mms].[_id] = [part].[mid])
ORDER BY [mms].[date]
