Evidence: Zoom Databases
Description: Collect Zoom Databases
Category: Applications
Platform: windows
Short Name: zmdb
Is Parsed: No
Sent to Investigation Hub: No
Collect File(s): Yes
Background
Zoom video conferencing application stores chat messages, meeting history, contacts, and configuration data in SQLite databases. These databases track meetings attended, participants, chat conversations, and shared files.
Data Collected
This collector gathers structured data about zoom databases.
Collection Method
This collector gathers SQLite database files from the Zoom user data directory, collecting chat, contacts, and meeting history databases.
Forensic Value
Zoom databases reveal meeting participation, chat communications, file transfers, and contact lists. This is valuable for investigating unauthorized meetings, data leaks, insider threats, and establishing communication timelines in corporate investigations.
