Messaging & email forensics
Parse every messaging app into one forensic timeline.
Drop Slack, email, Discord, Teams, WhatsApp, Telegram, iMessage, Signal, SMS and social-media exports. Get a unified, searchable timeline with indicators, hashes and exportable reports.
Runs entirely in your browser. Files are never uploaded.
Drop exports, databases or ZIP archives here
Files and folders are both accepted. Mixed sources are merged into one timeline.
Supported sources
Detection is automatic: drop files, folders or ZIP archives and each file is routed to the right parser.
Slack / Teams / Discord desktop apps
Point it at the desktop client's profile folder, or at loose files from a forensic export. LevelDB logs and tables are decoded by the Rust/WebAssembly engine, keeping overwritten and deleted versions, and records are carved from file slack. Slack, Teams and Discord messages are extracted from IndexedDB, Local Storage and cached API responses, and every raw record stays browsable in the Artifacts tab.
Accepts: LevelDB .log / .ldb (IndexedDB, Local Storage, Session Storage) · .indexeddb.blob files · Chromium HTTP cache (simple cache and blockfile) · File slack / unallocated chunks (record carving)
Read the guideEmail
Save messages as EML/MSG, or export a whole mailbox as MBOX. Headers are analyzed for Received hops, originating IPs, SPF/DKIM results and Reply-To mismatches.
Accepts: .eml · .emlx (Apple Mail) · .mbox (Gmail Takeout, Thunderbird) · .msg (Outlook)
Read the guideSlack
Workspace owners and admins export a ZIP from workspace settings. Drop the ZIP as-is: users, channels, DMs, threads, edits, reactions and file references are resolved.
Accepts: Workspace export .zip · users.json, channels.json, dms.json, <channel>/<date>.json
Read the guideDiscord
The official data package contains only the account owner's messages. For whole channels, use a DiscordChatExporter JSON or CSV export.
Accepts: Data package .zip (Messages/c<id>/messages.json|csv) · DiscordChatExporter JSON / CSV
Read the guideMicrosoft Teams
For tenants, export chats from Microsoft Purview eDiscovery as individual .msg items, or pull them via the Graph API. Teams (free) accounts can export their own data.
Accepts: Purview eDiscovery items (.msg, IPM.SkypeTeams.Message) · Microsoft Graph chatMessage JSON · Teams (free) personal export messages.json
Read the guideWhatsApp
Chat exports work on any phone. Full extractions (decrypted msgstore.db on Android, ChatStorage.sqlite on iOS) carry every chat with sender IDs and media references. Add wa.db to resolve contact names.
Accepts: Export chat .txt / .zip · Android msgstore.db (decrypted) + wa.db · iOS ChatStorage.sqlite
Read the guideTelegram
Telegram Desktop exports chats as machine-readable JSON. Choose JSON, not HTML, in the export dialog.
Accepts: Telegram Desktop export result.json (full or single chat)
Signal
Signal Desktop's database is encrypted with SQLCipher. Decrypt a copy with the key from the profile first, then load the plain SQLite file.
Accepts: Signal Desktop db.sqlite after SQLCipher decryption
iMessage / Apple SMS
On macOS, copy chat.db together with its -wal file; committed WAL frames are merged automatically. On iOS, extract sms.db from an unencrypted or decrypted backup. Text stored only in attributedBody (macOS 13+) is recovered.
Accepts: macOS chat.db · iOS sms.db (from a backup)
Read the guideAndroid SMS / MMS
Load XML from the SMS Backup & Restore app (texts, MMS parts and call logs) or the Android telephony database from a full-file-system extraction.
Accepts: SMS Backup & Restore XML (sms, mms, calls) · mmssms.db
Messenger / Instagram
Request a JSON (not HTML) download for Facebook or Instagram. Mis-encoded accents and emoji in Meta exports are repaired automatically.
Accepts: Download your information (JSON): messages/inbox/*/message_N.json
Google Chat / Hangouts
Select Google Chat in Takeout. Each DM or space folder contains messages.json and group_info.json. Legacy Hangouts.json is also supported.
Accepts: Takeout Google Chat Groups/*/messages.json (+ group_info.json) · Hangouts.json
Skype
Request your conversations from Skype's export page and load messages.json. The pre-2017 main.db database is also supported.
Accepts: Skype export messages.json · Legacy main.db
Viber
Viber for desktop keeps an unencrypted SQLite database per phone number.
Accepts: Viber desktop viber.db
LINE
Export a chat's history as text from the chat settings on the phone or desktop app.
Accepts: Chat history export .txt
Other apps
JSON arrays and CSV files from other apps are mapped by guessing the text, sender, time and channel fields. Check the result against the source.
Accepts: Any JSON / CSV with text + sender or time columns (field names guessed)
Where to find the evidence
Default locations and export paths for each source. Acquire a forensic copy first; work on the copy.
Slack / Teams / Discord desktop apps
- Slack (Windows)
- %APPDATA%\Slack\IndexedDB\https_app.slack.com_0.indexeddb.leveldb · Local Storage\leveldb · Cache\Cache_Data
- Slack (Microsoft Store)
- %LOCALAPPDATA%\Packages\<Slack package>\LocalCache\Roaming\Slack\…
- Slack (macOS)
- ~/Library/Application Support/Slack/… or ~/Library/Containers/com.tinyspeck.slackmacgap/Data/Library/Application Support/Slack/…
- Discord
- %APPDATA%\discord\Cache\Cache_Data · Local Storage\leveldb · IndexedDB (macOS: ~/Library/Application Support/discord/)
- Teams (classic)
- %APPDATA%\Microsoft\Teams\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb · Cache
- Teams (new)
- %LOCALAPPDATA%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\IndexedDB
- Thunderbird
- %APPDATA%\Thunderbird\Profiles\<profile>\ImapMail\<server>\INBOX
- Apple Mail
- ~/Library/Mail/V10/<account>/INBOX.mbox/…/Messages/*.emlx
- Gmail Takeout
- Takeout/Mail/All mail Including Spam and Trash.mbox
- Outlook
- %LOCALAPPDATA%\Microsoft\Outlook\*.ost / *.pst → export items as .msg
Slack
- Export
- Workspace settings → Import/Export Data → Export
- Desktop app
- see “Slack / Teams / Discord desktop apps”
Discord
- Data package
- User Settings → Data & Privacy → Request all of my data
- Desktop app
- see “Slack / Teams / Discord desktop apps”
Microsoft Teams
- eDiscovery
- Microsoft Purview → eDiscovery → Export → individual items
- Graph API
- GET /chats/{id}/messages · /teams/{id}/channels/{id}/messages
- Desktop app
- see “Slack / Teams / Discord desktop apps”
- Android
- /data/data/com.whatsapp/databases/msgstore.db · wa.db
- iOS
- AppDomainGroup-group.net.whatsapp.WhatsApp.shared/ChatStorage.sqlite
- Export
- Chat → ⋮ / contact name → Export chat
Telegram
- Export
- Telegram Desktop → Settings → Advanced → Export Telegram data → JSON
- Desktop data
- %APPDATA%\Telegram Desktop\tdata (encrypted — not parsed)
Signal
- Windows
- %APPDATA%\Signal\sql\db.sqlite (key: config.json / Local State)
- macOS
- ~/Library/Application Support/Signal/sql/db.sqlite
- Linux
- ~/.config/Signal/sql/db.sqlite
iMessage / Apple SMS
- macOS
- ~/Library/Messages/chat.db (+ -wal)
- iOS backup
- HomeDomain/Library/SMS/sms.db → 3d/3d0d7e5fb2ce288813306e4d4636395e047a3d28
Android SMS / MMS
- Android
- /data/data/com.android.providers.telephony/databases/mmssms.db
- Backup app
- SMS Backup & Restore → sms-<date>.xml · calls-<date>.xml
Messenger / Instagram
- Export
- Accounts Center → Your information and permissions → Download your information → JSON
Google Chat / Hangouts
- Takeout
- takeout.google.com → Google Chat → Takeout/Google Chat/Groups/
Skype
- Export
- go.skype.com/export → Conversations (messages.json in .tar)
- Legacy
- %APPDATA%\Skype\<username>\main.db
Viber
- Windows
- %APPDATA%\ViberPC\<phone number>\viber.db
- macOS
- ~/Library/Application Support/ViberPC/<phone number>/viber.db
LINE
- Export
- Chat → ≡ → Settings → Export chat history
Paths marked “not parsed” are listed so you know they exist; acquire them with a dedicated tool.
Frequently asked questions
Are my files uploaded anywhere?
No. Parsing, hashing and reporting all run in your browser, in a Web Worker. Evidence never leaves your machine, and the page keeps working offline once loaded.
Which messaging apps are supported?
Email (EML, EMLX, MBOX, Outlook MSG), Slack, Discord, Microsoft Teams, WhatsApp, Telegram, Signal Desktop, iMessage and Apple SMS, Android SMS/MMS, Facebook Messenger, Instagram, Google Chat and Hangouts, Skype, Viber and LINE. Other JSON or CSV chat exports are read by a field-guessing parser.
Can I load several sources at once?
Yes. Drop any mix of files, folders and ZIP archives. Every message is normalized to the same fields (time, platform, conversation, sender, text, attachments), so email, Slack and WhatsApp end up on one timeline.
How are timestamps handled?
Each format's native clock is converted to UTC: Unix seconds and milliseconds, Apple Cocoa time (seconds or nanoseconds since 2001), Windows FILETIME and RFC 2822 dates. WhatsApp and LINE text exports record device-local time with no time zone, so those rows are flagged. You can switch the display between UTC and your local time.
How do I preserve integrity for a report?
Every loaded file is SHA-256 hashed before it is parsed. The HTML report lists those hashes, the parser used for each file, the filters applied and every message in scope, so findings can be traced back to the acquired evidence.
Can it read encrypted databases like Signal, WhatsApp crypt14 or Telegram tdata?
No. Decrypt them first with the appropriate key and tooling, then load the plain SQLite database. Encrypted inputs are reported as not recognized; they are never silently skipped.