|
|
Article DetailsBrief introduction into the Windows Media Player program and analysis of currentdatabase_372.wmdb file and how to extract the content for review. This article may serve as an aid to forensic examiners or data recovery technicians.
Using FTK forensic software to detect SQLite Database Files for processing in SQLite Forensic Reporter
Processing SQLite Databases using Templates (applicable to forensic analysis and data recovery). This article covers the processing of SQLite database files for forensic analysis, security auditing and data recovery purposes.
SQLite Forensic Reporter is the most powerful tool available for analysing and reporting on the contents of SQLite database files on the market to date. With batch processing, advanced identification, decoding and reporting this is a perfect solution for computer & mobile phone examiners and data recovery technicians.
These days, catching a criminal involves the use of highly sophisticated technologies which can generate vital evidence good enough to prove whether a person is really guilty or not. One of the known applications that can be taken under consideration in such cases is the forensic software or data recovery software.
- Active Links: 13
- Pending Links: 1
- Todays Links: 0
- Total Articles: 26
- Total Categories: 3
- Sub Categories: 0
Windows Media Player Database CurrentDatabase_372.wmdb files |
| Date Added: December 29, 2011 01:55:04 PM |
| Author: admin |
| Category: Documents |
This article covers the program Microsoft Windows Media Player and analysis of the data file typically titled CurrentDatabase_372.wmdb and how to extract the content for review. This article may serve as an aid to forensic examiners or data recovery technicians. WMDB Extractor for CurrentDatabase_372.wmdb: Windows Media Player is a multimedia, video and music player program developed by Microsoft and comes installed as part of the Microsoft Windows operating system. Windows Media player will search a computer for compatible multimedia file types and automatically add to the library. A user can also add additional folders or storage devices containing supported file types. The library can be accessed via Media player, contents can be sorted, arranged and playlists created. The CurrentDatabase_372.wmdb is typically found on Windows 7. The library is saved to a single file, each user profile will contain an individual library with the file extension wmdb – on Windows Media Player 12 this file is called CurrentDatabase_372.wmdb. Depending on the version of player installed the file may be called CurrentDatabase_360.wmdb, CurrentDatabase_219.wmdb or CurrentDatabase_59R. There may also be a file titled ‘CorruptDatabase_XXX.wmdb’ where X denotes a number. The library file is located in the following location within each profile: VOLUMEUsersPROFILEAppDataLocalMicrosoftMedia Player Note: the location may vary depending on Windows Operating System version. The Windows media player library file (for example CurrentDatabase_372.wmdb) can be readily examined using the tool ‘WMDB Extractor for CurrentDatabase_372.wmdb’, a forensic software tool which is part of the Simple Carver Suite. The WMDB Extractor for CurrentDatabase_372.wmdb is capable of reading the wmdb file and save the contents to CSV, TXT and HTML file formats. WMDB Extractor for CurrentDatabase_372.wmdb: The Media player library file (example: CurrentDatabase_372.wmdb) contains a wealth of information including but not limited to File Path information, file properties, play counts, playlist information, video, music and photo file listings. For more forensic data recovery tools visit: www.filesig.co.uk |