msn.history

$ target-query <path/to/target> -f msn.history

Details

Module	dissect.target.plugins.apps.chat.msn.MSNPlugin
Output	records

Module documentation

Microsoft MSN Messenger plugin.

Supports the following versions on Windows XP and Windows 7:

• Windows Live Messenger (WLM) 2009

• MSN 7.5

Other versions might work but have not been tested. Does not support Messenger Plus! Live artifacts. Tested using Escargot (https://escargot.chat).

References:

• https://en.wikipedia.org/wiki/Microsoft_Messenger_service

• https://en.wikipedia.org/wiki/MSN_Messenger

• http://computerforensics.parsonage.co.uk/downloads/MSNandLiveMessengerArtefactsOfConversations.pdf

Function documentation

Yield MSN chat history messages.

Chat history artifacts can be found in:

• $HOME/My Documents/My Received Files/MsnMsgr.txt

• $HOME/My Documents/My Received Files/$username$PassportID/History/*.xml