← All artifacts

Facebook Messenger

Facebook Messenger desktop artifacts — Lightspeed SQLite databases holding messages, threads, contacts, calls and payments, plus cached media.

Status
available
CLI plugin
messaging.fbmessenger
Categories
communication, user

Overview

The Facebook Messenger desktop app for macOS (bundle ID com.facebook.archon) is a Mac Catalyst app, now discontinued. It stores its data in Lightspeed (MSYS) SQLite databases inside its sandbox container, under Messenger/Partitions/. macfor parses these databases for messages, threads, contacts, calls, searches, payments, activity and account details. It also collects the media cache, the cookies file and the preferences plist. The plugin supports macOS 10.15 and later.

Analysis Tips

  • Encrypted databases: After the end-to-end encryption rollout, some Lightspeed databases are encrypted. macfor detects this from the file header and copies encrypted databases as raw files instead of parsing them
  • FBIDs: Senders, contacts and payment participants are identified by Facebook IDs. Use the contacts records to map FBIDs to names
  • Search records: Search entries show which contacts the user looked up, with the target FBID
  • Media cache: Cached thumbnails and profile pictures can show content and contacts even when messages are gone
  • Limited offline data: Messenger keeps most history on the server, so older conversations may not be stored locally

Related Artifacts

  • WhatsApp - Another third-party messenger with local SQLite storage
  • Signal - Encrypted messenger with local database storage
  • Quarantine Events - Confirm where the Messenger installer originated

References

Data sources

lightspeed-*.dbSQLite

~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions/*/

Messages, threads, contacts, call history, searches, payments, activity and account records. The com.facebook.archon.developerID container is also checked.

Cache directoriesBinary (images, video thumbnails, stickers)

~/Library/Caches/com.facebook.archon/ and the container's Data/Library/Caches/com.facebook.archon/

Cached profile pictures, image and video thumbnails, and sticker packs

Cookies.binarycookiesBinary cookies

~/Library/Containers/com.facebook.archon/Data/Library/Cookies/

Session cookies, copied as a raw file

com.facebook.archon.plistProperty List

~/Library/Preferences/

App preferences and account metadata