A forensic open-source parser module for Autopsy that allows extracting the messages, comments, posts, contacts, calendar entries and reactions from a Microsoft Teams IndexedDB LevelDB database.
MIT License
Forensics.im is an Autopsy Plugin, which allows parsing levelDB of modern Electron-based Instant Messenger Applications like Microsoft Teams. Unlike the existing levelDB plugin, Forensics.im also parses the binary ldb files, which contain the majority of the entries and allows identifies individual entities, such as messages and contacts, and presets these in Autopsy's blackboard view.
This parser has been tested using:
This plugin is an artefact of the Master Thesis Digital Forensic Acquisition and Analysis of Artefacts Generated by Microsoft Teams at the University of Abertay, Dundee, United Kingdom.
If you are curious about the artefacts that are generate by Microsoft Teams, I would like to refer you to my in-depth blog post on my personal website. It discusses in great details which file are created by Microsoft Teams and how these could be utilised in a forensic investigation.
This module requires the installation of Autopsy v4.18 or above and a Windows-based system.
To install the Microsoft Teams parser for Autopsy, please follow these steps:
forensicsim.zip
folder of the latest available release..zip
folder onto your computer.%AppData%\autopsy\python_modules
.forensicsim
folder within the python_modules
folder.ms_teams_parser.exe
and the Forensicsim_Parser.py
to the forensicsim
directory.You can test verify that the module has installed successfully by performing the following steps:
The standalone parser script writes all the processed and identified records into a structured JSON file, which can either be processed by the Autopsy Plugin or in another application.
The main parser script can be used like this:
.\dist\ms_teams_parser.exe -f ".\forensicsim-data\john_doe_old_teams\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb" -o "john_doe.json"
Feel free to use the LevelDB files provided in this repository.
The parser has the following options:
Options:
-f, --filepath PATH File path to the .leveldb folder of the IndexedDB.
[required]
-o, --outputpath PATH File path to the processed output. [required]
-b, --blobpath PATH File path to the .blob folder of the IndexedDB.
--help Show this message and exit.
pyinstaller "main.spec"
This script allows dumping a Microsoft Teams LevelDB to a json file, without processing it further. The usage is as following. Simply specify the path to the database and where you want to output the JSON file.
usage: dump_leveldb.py [-h] -f FILEPATH -o OUTPUTPATH
dump_leveldb.py: error: the following arguments are required: -f/--filepath, -o/--outputpath
A wee script for populating Skype for Desktop in a lab environment. The script can be used like this:
tools\populate_skype.py -a 0 -f conversation.json
A wee script for populating Microsoft Teams in a lab environment. The script can be used like this:
tools\populate_teams.py -a 0 -f conversation.json
This repository comes with two datasets that allow reproducing the findings of this work. The testdata
folder contains the LevelDB databases that have been extracted from two test clients. These can be used for benchmarking without having to perform a (lengthy) data population.
The populationdata
contains JSON files of the communication that has been populated into the testing environment. These can be used to reproduce the experiment from scratch. However, for a rerun, it will be essential to adjust the dates to future dates, as the populator script relies on sufficient breaks between the individual messages.