dissect.target.plugins.apps.chat.msn

Module Contents

Classes

MSNPlugin

Microsoft MSN Messenger plugin.

Functions

convert_email

Convert MSN email address to 10 digit Passport ID.

class dissect.target.plugins.apps.chat.msn.MSNPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.apps.chat.chat.ChatPlugin

Microsoft MSN Messenger plugin.

Supports the following versions on Windows XP and Windows 7:

• Windows Live Messenger (WLM) 2009

• MSN 7.5

Other versions might work but have not been tested. Does not support Messenger Plus! Live artifacts. Tested using Escargot (https://escargot.chat).

References

• https://en.wikipedia.org/wiki/Microsoft_Messenger_service

• https://en.wikipedia.org/wiki/MSN_Messenger

• http://computerforensics.parsonage.co.uk/downloads/MSNandLiveMessengerArtefactsOfConversations.pdf

__namespace__ = 'msn'

Defines the plugin namespace.

DATA_PATH = 'Application Data\\Microsoft\\MSN Messenger'

HIST_PATH = 'My Documents\\My Received Files'

installs

find_installs() → collections.abc.Iterator[tuple[dissect.target.plugins.general.users.UserDetails, dissect.target.helpers.fsutil.TargetPath]]

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

history() → collections.abc.Iterator[dissect.target.plugins.apps.chat.chat.ChatMessageRecord | dissect.target.plugins.apps.chat.chat.ChatAttachmentRecord]

Yield MSN chat history messages.

Chat history artifacts can be found in:

• $HOME/My Documents/My Received Files/MsnMsgr.txt

• $HOME/My Documents/My Received Files/$username$PassportID/History/*.xml

dissect.target.plugins.apps.chat.msn.convert_email(string: str) → int

Convert MSN email address to 10 digit Passport ID.