Has anyone ever had any involvement with forensics on a PC trying to get any chat logs when the user uses google talk messenger? I have used it breifly and I know past chat logs are saved on googles servers, I just wondered if there would be any logs saved locally on the PC where the tool is installed as a general rule, or not likely?
Also, is there any tool to see where such logs may be written to in real time, i.e. a tool to scan what programs are saving what data locally? So its easy to narrow down where?
The PC is Windows XP.I read a few articles on instant messenger foresnics and it didnt sound to promising that there would be much in terms of past log history locally, but you may have more experience then those writing the posts/blog entries.
Or any specific software you would recommend that is useful to carve / recover any local google talk artifacts.
If you are willing, a general "you wont find any gtalk artifacts locally", "you may find some snippets of logs locally but not a comprehensive history of every chat every taken place", "you will find all previous logs going back X months" type view based on your experience most welcome to help determine if its worth paying someone to investigate.