Forensics Journal - Stevenson University 2013 | Page 70

FORENSICS JOURNAL

Once the user deletes a voicemail, the corresponding “.dat” file is
deleted. These files may be found among the deleted files on the
computer (Shafer, Skype Data Experiments).

phone numbers and SMS messages, the chance of finding this information in deleted or carved spaces on the hard drive increases.
VOICEMAIL

CALL FORWARDING

Each voicemail recording is stored in the Skype user’s “voicemail”
folder and named “V#.dat.” The data file name can be found in the
“path” field of the “voicemails” table, in “main.db.” Therefore in
Figure 7, for the voicemail received on 10/13/12 at 11:27 am, the
corresponding “.dat” file is named “V1350142942M1M1000000
119D2624683532.dat.” Both voicemails received by the user, as
well as voicemails left by the user, are recorded by Skype. The “type”
field keeps track of whether the voicemail was received, “1” or left,
“3.” The greeting heard when a voicemail is left will be displayed as
type “2.” The “timestamp” field holds the epoch date and time of the
voicemail. The actual content of the “.dat” voicemail file is proprietary and Skype must be used to listen to the call (Shafer, Skype Data
Experiments).

Another paid feature of Skype is call forwarding. Skype users turn on
call forwarding at the Skype website by entering an alternate number
for forwarding purposes. When they are off-line, all Skype calls are
automatically forwarded to a phone number (Skype, Inc.). It should
be noted that call