Pro plugin

Facebook Messenger Desktop

Collects chat messages, conversation threads, contacts, payment records, search activity, call history, and cached media from the discontinued Facebook Messenger Desktop app

messaging.fbmessengerPromacOS 10.15+v1.0.0communicationusermessaging

Run this plugin

Trigger collection for Facebook Messenger Desktop on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin messaging.fbmessenger --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin messaging.fbmessenger --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts collected (10)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optional artifacts are skipped unless explicitly enabled.

messaging

Artifact	Format	Path	Notes
Facebook Messenger Messages fbmessenger_messagesSensitivehigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db` +1 more ~/Library/Containers/com.facebook.archon.developerID/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db	Chat messages from the Lightspeed/MSYS SQLite database including sender FBIDs, timestamps, and message content.
Facebook Messenger Threads fbmessenger_threadsSensitivehigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Conversation threads with participant counts, folder types, last message previews, and unread counts.
Facebook Messenger Contacts fbmessenger_contactsSensitivehigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Contact records including names, FBIDs, friend status, and phone numbers.
Facebook Messenger Call History fbmessenger_callsSensitivehigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Voice and video call history including participants, timestamps, and duration.
Facebook Messenger Searches fbmessenger_searchesSensitivemedium value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Search tokens with target FBIDs indicating which contacts the user searched for.
Facebook Messenger Payments fbmessenger_paymentsSensitivehigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Payment requests and transfers including amounts, currencies, and participant FBIDs.

media

Artifact	Format	Path	Notes
Facebook Messenger Media Cache fbmessenger_mediaSensitivemedium value	binary	`~/Library/Containers/com.facebook.archon/Data/Library/Caches/com.facebook.archon/` +2 more ~/Library/Caches/com.facebook.archon/ ~/Library/Caches/14c12d71.com.facebook.archon/	Cached profile pictures, image thumbnails, video thumbnails, and sticker packs.

metadata

Artifact	Format	Path	Notes
Facebook Messenger Activity fbmessenger_activitymedium value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db`	Application activity logs including sync timestamps and usage patterns.
Facebook Messenger Accounts fbmessenger_accountshigh value	sqlite	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db` +1 more ~/Library/Preferences/com.facebook.archon.plist	Account identification including FBIDs, database paths, encryption status, and container information.
Facebook Messenger Raw Files fbmessenger_rawOptionalhigh value	binary	`~/Library/Containers/com.facebook.archon/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db` +1 more ~/Library/Containers/com.facebook.archon.developerID/Data/Library/Application Support/Messenger/Partitions//lightspeed-.db	Raw database files collected for offline analysis. Always collected when the database is encrypted.