Messaging & email forensics
Parse every messaging app into one forensic timeline.
Drop Slack, email, Discord, Teams, WhatsApp, Telegram, iMessage, Signal, SMS and social-media exports. Get a unified, searchable timeline with indicators, hashes and exportable reports.
Runs entirely in your browser. Files are never uploaded.
Drop exports, databases or ZIP archives here
Files and folders are both accepted, including Outlook .pst/.ost mailboxes of any size. Mixed sources are merged into one timeline.
Synthetic, fictional intrusion case (phishing invoice → stolen login → exfiltration) — no real people or data. Tip: pick “Time range → Last hour” or click a message time to zoom on the incident window.
How to get your data
Pick your platform, follow its official export path, then drop what it produces onto this page. Easiest routes first.
- CollectExport or copy the data with one of the methods below.
- Drop it hereDrop the file, folder or ZIP as-is. No need to unzip.
- Stays in your browserRuns entirely in your browser. Files are never uploaded.
Needs The phone with the chat. One chat per export.
- Android: open the chat → ⋮ → More → Export chat → Without media (or Include media).
- iPhone: open the chat → tap the contact or group name → Export Chat → Without Media → Save to Files.
Drop: The .zip or .txt as-is. Keep the ZIP name: it carries the chat title.
Telegram
Needs Telegram Desktop (the phone apps cannot export).
- All chats: Settings → Advanced → Export Telegram data.
- One chat: open it → ⋮ → Export chat history.
- Set the format to “Machine-readable JSON”, then Export.
Drop: result.json, or the whole export folder.
LINE
Needs The LINE app on the phone or desktop.
- Open the chat → ≡ (menu) → Settings → Export chat history.
- Save or send the .txt file to your computer.
Drop: The .txt as-is.
Needs Nothing extra. A whole Gmail mailbox comes through Google Takeout.
- Gmail: open the message → ⋮ → Download message (.eml).
- Classic Outlook for Windows: drag the message to a folder (.msg). Thunderbird: File → Save As → File (.eml). Apple Mail: drag the message to Finder (.eml).
- Whole Gmail mailbox: takeout.google.com → Deselect all → Mail → Next step → Create export.
Drop: .eml, .msg or .emlx files, an .mbox, the Takeout ZIP as-is, or a whole Outlook .pst/.ost (see “Phone extraction or disk image”).
Messenger / Instagram
Needs The Facebook or Instagram account's login.
- Accounts Center → Your information and permissions → Download your information.
- Choose the profile → Specific types of information → Messages → Download to device.
- Set the format to JSON (not HTML), then Create files. Meta notifies you when it is ready.
Drop: The ZIP as-is (every part if it is split).
Google Chat
Needs The Google account's login.
- takeout.google.com → Deselect all → tick Google Chat → Next step.
- Keep the .zip file type, then Create export and download it.
Drop: The Takeout ZIP as-is (messages.json and group_info.json stay together).
Discord
Needs The account's login. Delivery can take days (Discord allows up to 30).
- User Settings → Data & Privacy → Request all of my data.
- Select Messages, submit, then download the ZIP from the emailed link.
Drop: The package ZIP as-is. It holds only this account's own messages.
Android SMS
Needs The SMS Backup & Restore app on the Android phone.
- Open the app → Back up now → select Messages (and Calls) → local backup.
- Copy sms-<date>.xml (and calls-<date>.xml) to your computer.
Drop: The .xml files.
Slack
Needs Workspace Owner or Admin. Private channels and DMs need a paid-plan export approved by Slack.
- Workspace name → Tools & settings → Workspace settings → Import/Export Data → Export.
- Pick the date range → Start Export, then download the ZIP from the link Slack sends.
Drop: The export ZIP as-is.
Microsoft Teams
Needs Tenant export: an eDiscovery role in Microsoft Purview. Graph: consent to the Chat.Read permission.
- Microsoft Purview → eDiscovery → open or create a case → search the custodians' Teams content.
- Export → choose individual messages (.msg), not PST, then download.
- One chat via Microsoft Graph: run the command below (replace <chat-id>; list IDs with GET /me/chats). Each call saves one page: repeat with the @odata.nextLink URL.
Connect-MgGraph -Scopes "Chat.Read"
New-Item -ItemType Directory -Force -Path C:\triage | Out-Null
Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/chats/<chat-id>/messages" -OutputFilePath C:\triage\teams-chat.jsonDrop: The downloaded .msg folder or ZIP, or the saved JSON pages.
iMessage (Mac)
Needs Terminal needs Full Disk Access (System Settings → Privacy & Security). Quit Messages first.
- Run the command. It copies chat.db together with its -wal and -shm files.
mkdir -p ~/triage/messages && cp -p ~/Library/Messages/chat.db* ~/triage/messages/Drop: The ~/triage/messages folder.
Skype
Needs An export downloaded before Skype was retired in May 2025.
- Extract messages.json from the downloaded .tar (double-click on macOS, or tar -xf on Windows).
- The legacy main.db database (%APPDATA%\Skype\<username>\main.db) is read as well.
Drop: messages.json or main.db.
Quit the app, then copy its profile folder. The copies land in C:\triage (Windows) or ~/triage (macOS): drop that folder.
Slack desktop
Needs Quit Slack first.
- Copies the profile: IndexedDB, Local Storage and the HTTP cache. Microsoft Store and Mac App Store installs use the other paths listed under “Where to find the evidence”.
Windows · Command Promptrobocopy "%APPDATA%\Slack" C:\triage\Slack /E /R:0 /W:0 /XD "Code Cache" GPUCachemacOS · Terminalmkdir -p ~/triage && cp -Rp "$HOME/Library/Application Support/Slack" ~/triage/SlackDrop: The copied Slack folder.
Microsoft Teams desktop
Needs Quit Teams first.
- Use the command for the installed client. New Teams keeps its data in a WebView2 profile.
Windows · Command Prompt · new Teamsrobocopy "%LOCALAPPDATA%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw" C:\triage\Teams /E /R:0 /W:0 /XD "Code Cache" GPUCacheWindows · Command Prompt · classic Teamsrobocopy "%APPDATA%\Microsoft\Teams" C:\triage\TeamsClassic /E /R:0 /W:0 /XD "Code Cache" GPUCacheDrop: The copied Teams folder.
Discord desktop
Needs Quit Discord, including the tray icon.
- Copies IndexedDB, Local Storage and the HTTP cache with its cached API responses.
Windows · Command Promptrobocopy "%APPDATA%\discord" C:\triage\discord /E /R:0 /W:0 /XD "Code Cache" GPUCachemacOS · Terminalmkdir -p ~/triage && cp -Rp "$HOME/Library/Application Support/discord" ~/triage/discordDrop: The copied discord folder.
Viber desktop
Needs Quit Viber first.
- Copies viber.db for every registered phone number, keeping the per-number folders.
Windows · Command Promptrobocopy "%APPDATA%\ViberPC" C:\triage\Viber viber.db* /S /R:0 /W:0macOS · Terminalmkdir -p ~/triage && cp -Rp "$HOME/Library/Application Support/ViberPC" ~/triage/ViberPCDrop: The copied Viber folder.
KAPE
Needs KAPE (Kroll), run as administrator.
- The MessagingClients compound target collects the desktop messaging apps' profile folders, including files locked by a running app.
Windows · Command Prompt (administrator)kape.exe --tsource C: --tdest C:\triage\kape --target MessagingClientsDrop: The C:\triage\kape folder.
Velociraptor
Needs A Velociraptor server or an offline collector.
- Collect the Windows.Triage.Targets artifact (Velociraptor Triage project) with the MessagingClients target ticked. On older releases, use Windows.KapeFiles.Targets instead.
- Download the collection ZIP.
Drop: The collection ZIP as-is.
From a full-file-system extraction, a device backup or a mounted disk image (FTK Imager, Arsenal Image Mounter, icat), export these files and drop them together.
WhatsApp (Android)
Needs A full-file-system extraction. Encrypted msgstore.db.crypt14/15 backups must be decrypted with the key first.
- Export both databases, plus msgstore.db-wal if present.
- /data/data/com.whatsapp/databases/msgstore.db
- /data/data/com.whatsapp/databases/wa.db
Drop: msgstore.db and wa.db together.
WhatsApp (iPhone)
Needs A full-file-system extraction or a decrypted iPhone backup.
- Export ChatStorage.sqlite (and its -wal if present) from WhatsApp's shared app group.
- AppDomainGroup-group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite
Drop: ChatStorage.sqlite.
iPhone Messages (Finder / iTunes backup)
Needs An unencrypted backup, or one decrypted with its password.
- sms.db (HomeDomain/Library/SMS/sms.db) has this hashed name in every backup. Copy it: the file name does not matter.
- ~/Library/Application Support/MobileSync/Backup/<device-id>/3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
- %APPDATA%\Apple Computer\MobileSync\Backup\<device-id>\3d\3d0d7e5fb2ce288813306e4d4636395e047a3d28
Drop: The copied file.
Android SMS / MMS
Needs A full-file-system extraction.
- The path depends on the Android version. Export mmssms.db with its -wal file.
- /data/data/com.android.providers.telephony/databases/mmssms.db
- /data/user_de/0/com.android.providers.telephony/databases/mmssms.db
Drop: mmssms.db.
Signal Desktop
Needs The SQLCipher key from the Signal profile. This tool does not decrypt.
- Decrypt a copy with SQLCipher and save it as a plain SQLite database.
- %APPDATA%\Signal\sql\db.sqlite
- ~/Library/Application Support/Signal/sql/db.sqlite
- ~/.config/Signal/sql/db.sqlite
Drop: The decrypted database.
Outlook PST / OST
Needs Outlook closed (an open .pst/.ost is locked), or a disk image. New Outlook for Windows keeps no .ost for Microsoft 365 accounts and has limited PST support: use classic Outlook or a Microsoft Purview eDiscovery (PST) export for a whole mailbox.
- Quit Outlook, then copy the data files: .ost (cached Exchange / Microsoft 365 mailboxes) from %LOCALAPPDATA%\Microsoft\Outlook, .pst (archives, POP/IMAP accounts, exports) usually from Documents\Outlook Files.
- Or in classic Outlook: File → Open & Export → Import/Export → Export to a file → Outlook Data File (.pst), select the mailbox and tick Include subfolders.
- Drop the .ost as-is: it is read directly, including Outlook 2013+ OSTs with compressed blocks. No conversion needed.
Windows · Command Prompt (Outlook closed)robocopy "%LOCALAPPDATA%\Microsoft\Outlook" C:\triage\Outlook *.ost *.pst /R:0 /W:0 robocopy "%USERPROFILE%\Documents\Outlook Files" C:\triage\Outlook *.pst /R:0 /W:0- %LOCALAPPDATA%\Microsoft\Outlook\<account>.ost
- %USERPROFILE%\Documents\Outlook Files\*.pst
- %LOCALAPPDATA%\Microsoft\Outlook\*.pst (Outlook 2007 and earlier)
Drop: The .pst or .ost file (any size: it is read piece by piece in your browser, never uploaded). Deleted Items and Recoverable Items appear as folders; a PST password does not encrypt the data, so protected files open too.
Some sources need a companion file next to them. Drop them together, or drop the whole folder or ZIP.
- chat.db · chat.db-wal · chat.db-shm
- The WAL holds the newest messages, edits and deletions; committed frames are merged automatically.
- msgstore.db · msgstore.db-wal · wa.db
- wa.db turns phone numbers into contact names.
- messages.json · group_info.json
- group_info.json names the DM or space. Keep both files in their folder.
- …indexeddb.leveldb/ · …indexeddb.blob/ · Local Storage/leveldb/ · Cache/Cache_Data/
- Drop the whole profile folder: the blob folder holds large values stored outside LevelDB.
- Slack · Discord · Meta · Google Takeout · WhatsApp (.zip)
- Drop the downloaded archive unopened. Its layout identifies the export, and its hash goes into the report.
Gotchas
- Quit the app before copying a database or profile folder, and copy the -wal file with it. A copy taken from a running app can be locked, incomplete or miss the newest messages.
- WhatsApp and LINE text exports print the phone's local time with no time zone. Note the device's time zone when you collect.
- Exports are scoped: a Discord package holds only the owner's messages, a standard Slack export only public channels, and a WhatsApp chat export can be truncated. Encrypted stores (WhatsApp crypt14/15, Signal, Telegram tdata) must be decrypted first.
- An Outlook .ost is a local cache of a server mailbox: items outside the sync window, or never downloaded, are not in it. When completeness matters, also collect a PST export from classic Outlook or a Microsoft Purview eDiscovery export.
Supported sources
Detection is automatic: drop files, folders or ZIP archives and each file is routed to the right parser.
Slack / Teams / Discord desktop apps
Point it at the desktop client's profile folder, or at loose files from a forensic export. LevelDB logs and tables are decoded by the Rust/WebAssembly engine, keeping overwritten and deleted versions, and records are carved from file slack. Slack, Teams and Discord messages are extracted from IndexedDB, Local Storage and cached API responses, and every raw record stays browsable in the Artifacts tab.
Accepts: LevelDB .log / .ldb (IndexedDB, Local Storage, Session Storage) · .indexeddb.blob files · Chromium HTTP cache (simple cache and blockfile) · File slack / unallocated chunks (record carving)
Read the guideEmail
Save messages as EML/MSG, export a whole mailbox as MBOX, or drop an Outlook PST/OST as-is. Headers are analyzed for Received hops, originating IPs, SPF/DKIM results and Reply-To mismatches.
Accepts: .eml · .emlx (Apple Mail) · .mbox (Gmail Takeout, Thunderbird) · .msg (Outlook) · .pst / .ost (Outlook, ANSI, Unicode and 2013+ OST)
Read the guideSlack
Workspace owners and admins export a ZIP from workspace settings. Drop the ZIP as-is: users, channels, DMs, threads, edits, reactions and file references are resolved.
Accepts: Workspace export .zip · users.json, channels.json, dms.json, <channel>/<date>.json
Read the guideDiscord
The official data package contains only the account owner's messages. For whole channels, use a DiscordChatExporter JSON or CSV export.
Accepts: Data package .zip (Messages/c<id>/messages.json|csv) · DiscordChatExporter JSON / CSV
Read the guideMicrosoft Teams
For tenants, export chats from Microsoft Purview eDiscovery as individual .msg items, or pull them via the Graph API. Teams (free) accounts can export their own data.
Accepts: Purview eDiscovery items (.msg, IPM.SkypeTeams.Message) · Microsoft Graph chatMessage JSON · Teams (free) personal export messages.json
Read the guideWhatsApp
Chat exports work on any phone. Full extractions (decrypted msgstore.db on Android, ChatStorage.sqlite on iOS) carry every chat with sender IDs and media references. Add wa.db to resolve contact names.
Accepts: Export chat .txt / .zip · Android msgstore.db (decrypted) + wa.db · iOS ChatStorage.sqlite
Read the guideTelegram
Telegram Desktop exports chats as machine-readable JSON. Choose JSON, not HTML, in the export dialog.
Accepts: Telegram Desktop export result.json (full or single chat)
Signal
Signal Desktop's database is encrypted with SQLCipher. Decrypt a copy with the key from the profile first, then load the plain SQLite file.
Accepts: Signal Desktop db.sqlite after SQLCipher decryption
iMessage / Apple SMS
On macOS, copy chat.db together with its -wal file; committed WAL frames are merged automatically. On iOS, extract sms.db from an unencrypted or decrypted backup. Text stored only in attributedBody (macOS 13+) is recovered.
Accepts: macOS chat.db · iOS sms.db (from a backup)
Read the guideAndroid SMS / MMS
Load XML from the SMS Backup & Restore app (texts, MMS parts and call logs) or the Android telephony database from a full-file-system extraction.
Accepts: SMS Backup & Restore XML (sms, mms, calls) · mmssms.db
Messenger / Instagram
Request a JSON (not HTML) download for Facebook or Instagram. Mis-encoded accents and emoji in Meta exports are repaired automatically.
Accepts: Download your information (JSON): messages/inbox/*/message_N.json
Google Chat / Hangouts
Select Google Chat in Takeout. Each DM or space folder contains messages.json and group_info.json. Legacy Hangouts.json is also supported.
Accepts: Takeout Google Chat Groups/*/messages.json (+ group_info.json) · Hangouts.json
Skype
Skype was retired in May 2025, so only an export downloaded before the shutdown can be used: load messages.json from its .tar. The pre-2017 main.db database is also supported.
Accepts: Skype export messages.json · Legacy main.db
Viber
Viber for desktop keeps an unencrypted SQLite database per phone number.
Accepts: Viber desktop viber.db
LINE
Export a chat's history as text from the chat settings on the phone or desktop app.
Accepts: Chat history export .txt
Other apps
JSON arrays and CSV files from other apps are mapped by guessing the text, sender, time and channel fields. Check the result against the source.
Accepts: Any JSON / CSV with text + sender or time columns (field names guessed)
Where to find the evidence
Default locations and export paths for each source. Acquire a forensic copy first; work on the copy.
Slack / Teams / Discord desktop apps
- Slack (Windows)
- %APPDATA%\Slack\IndexedDB\https_app.slack.com_0.indexeddb.leveldb · Local Storage\leveldb · Cache\Cache_Data
- Slack (Microsoft Store)
- %LOCALAPPDATA%\Packages\<Slack package>\LocalCache\Roaming\Slack\…
- Slack (macOS)
- ~/Library/Application Support/Slack/… or ~/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/…
- Discord
- %APPDATA%\discord\Cache\Cache_Data · Local Storage\leveldb · IndexedDB (macOS: ~/Library/Application Support/discord/)
- Teams (classic)
- %APPDATA%\Microsoft\Teams\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb · Cache
- Teams (new)
- %LOCALAPPDATA%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\IndexedDB
- Thunderbird
- %APPDATA%\Thunderbird\Profiles\<profile>\ImapMail\<server>\INBOX
- Apple Mail
- ~/Library/Mail/V10/<account>/INBOX.mbox/…/Messages/*.emlx
- Gmail Takeout
- Takeout/Mail/All mail Including Spam and Trash.mbox
- Outlook (cached mailbox)
- %LOCALAPPDATA%\Microsoft\Outlook\*.ost
- Outlook (data files)
- %USERPROFILE%\Documents\Outlook Files\*.pst
Slack
- Export
- Workspace settings → Import/Export Data → Export
- Desktop app
- see “Slack / Teams / Discord desktop apps”
Discord
- Data package
- User Settings → Data & Privacy → Request all of my data
- Desktop app
- see “Slack / Teams / Discord desktop apps”
Microsoft Teams
- eDiscovery
- Microsoft Purview → eDiscovery → Export → individual items
- Graph API
- GET /chats/{id}/messages · /teams/{id}/channels/{id}/messages
- Desktop app
- see “Slack / Teams / Discord desktop apps”
- Android
- /data/data/com.whatsapp/databases/msgstore.db · wa.db
- iOS
- AppDomainGroup-group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite
- Export
- Chat → ⋮ / contact name → Export chat
Telegram
- Export
- Telegram Desktop → Settings → Advanced → Export Telegram data → JSON
- Desktop data
- %APPDATA%\Telegram Desktop\tdata (encrypted — not parsed)
Signal
- Windows
- %APPDATA%\Signal\sql\db.sqlite (key: config.json / Local State)
- macOS
- ~/Library/Application Support/Signal/sql/db.sqlite
- Linux
- ~/.config/Signal/sql/db.sqlite
iMessage / Apple SMS
- macOS
- ~/Library/Messages/chat.db (+ -wal)
- iOS backup
- HomeDomain/Library/SMS/sms.db → 3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
Android SMS / MMS
- Android
- /data/data/com.android.providers.telephony/databases/mmssms.db
- Backup app
- SMS Backup & Restore → sms-<date>.xml · calls-<date>.xml
Messenger / Instagram
- Export
- Accounts Center → Your information and permissions → Download your information → JSON
Google Chat / Hangouts
- Takeout
- takeout.google.com → Google Chat → Takeout/Google Chat/Groups/
Skype
- Export
- Only an export downloaded before Skype was retired (May 2025): messages.json in the .tar
- Legacy
- %APPDATA%\Skype\<username>\main.db
Viber
- Windows
- %APPDATA%\ViberPC\<phone number>\viber.db
- macOS
- ~/Library/Application Support/ViberPC/<phone number>/viber.db
LINE
- Export
- Chat → ≡ → Settings → Export chat history
Paths marked “not parsed” are listed so you know they exist; acquire them with a dedicated tool.
Frequently asked questions
Are my files uploaded anywhere?
No. Parsing, hashing and reporting all run in your browser, in a Web Worker. Evidence never leaves your machine, and the page keeps working offline once loaded.
Which messaging apps are supported?
Email (EML, EMLX, MBOX, Outlook MSG, PST and OST), Slack, Discord, Microsoft Teams, WhatsApp, Telegram, Signal Desktop, iMessage and Apple SMS, Android SMS/MMS, Facebook Messenger, Instagram, Google Chat and Hangouts, Skype, Viber and LINE. Other JSON or CSV chat exports are read by a field-guessing parser.
Can it open large Outlook PST or OST files?
Yes. PST (ANSI and Unicode) and OST files, including Outlook 2013+ OSTs with 4 KiB pages and compressed blocks, are decoded in your browser by a WebAssembly engine that reads the file piece by piece, so multi-gigabyte mailboxes are never loaded whole or uploaded. Every folder, Deleted Items and Recoverable Items included, appears in a folder tree; attachments are hashed and can be downloaded. Items already purged from the file (free space) are not carved.
Can I load several sources at once?
Yes. Drop any mix of files, folders and ZIP archives. Every message is normalized to the same fields (time, platform, conversation, sender, text, attachments), so email, Slack and WhatsApp end up on one timeline.
How are timestamps handled?
Each format's native clock is converted to UTC: Unix seconds and milliseconds, Apple Cocoa time (seconds or nanoseconds since 2001), Windows FILETIME and RFC 2822 dates. WhatsApp and LINE text exports record device-local time with no time zone, so those rows are flagged. You can switch the display between UTC and your local time.
How do I preserve integrity for a report?
Every loaded file is SHA-256 hashed before it is parsed. The HTML report lists those hashes, the parser used for each file, the filters applied and every message in scope, so findings can be traced back to the acquired evidence.
Can it read encrypted databases like Signal, WhatsApp crypt14 or Telegram tdata?
No. Decrypt them first with the appropriate key and tooling, then load the plain SQLite database. Encrypted inputs are reported as not recognized; they are never silently skipped.