10 KiB
10 KiB
N12-pre zyl Evidence Index
Date: 2026-07-09
Evidence id: zyl-qqfile-20260709
Archive: runs/offline-evidence-intake/zyl-qqfile-20260709/archives/zyl.rar
SHA256: 126CC72F21293829FED374321A2AFE6E067959B63A76981BCB6678C64E887173
Archive type: RAR5
Archive listing summary: 3931 files, 439 folders
Source metadata: runs/offline-evidence-intake/zyl-qqfile-20260709/metadata/archive-list.txt
Current conclusion
The N12-pre package contains a strong local-data candidate for Stage C read tools:
MsgLib.dbfiles underzyl\iSphere\...\Account\...andzyl\Impp\Account\....importal\localcachecommunication logs:Smark.SendReceive,SaveToDB,PacketReader.ProcessPacket, andLoginInfo.importal\<hash>document/cache directories that can later be mapped to message DB or log references for file receive/download.
The first Stage C source candidate should be the latest visible iSphere DB for account 90005981, with IMPP DB and communication logs as comparison/fallback evidence.
Candidate counts from archive list
| Candidate family | Count / summary | Evidence examples |
|---|---|---|
MsgLib.db total |
14 files | 12 under zyl\iSphere\...\Account\..., 2 under zyl\Impp\Account\... |
| SQLite runtime files | 4 files | System.Data.SQLite.dll and System.Data.SQLite.xml under both zyl\iSphere and zyl\Impp |
LoginInfo logs |
18 log files | account/session context |
PacketReader.ProcessPacket logs |
19 log files | packet/message processing trace |
SaveToDB logs |
15 log files | DB persistence trace |
Smark.SendReceive logs |
24 log files | send/receive transport trace; largest observed file is 10,486,426 bytes |
Hashed zyl\importal\<hash> file-cache entries |
11 files plus hashed folders | likely document/file receive cache candidates |
Candidate source families
| Family | Evidence path examples | Why it matters | Initial action |
|---|---|---|---|
| SQLite runtime | zyl\iSphere\System.Data.SQLite.dll; zyl\Impp\System.Data.SQLite.dll |
Confirms bundled SQLite usage around message libraries | record versions and inspect dependent DB files |
| iSphere message DB | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db; zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\duyanming0731\MsgLib.db |
Strong candidate for isphere_receive_messages, contacts, groups, and attachment references |
extract selected DB copies and inspect schema |
| IMPP message DB | zyl\Impp\Account\90005981\MsgLib.db; zyl\Impp\Account\27091282\MsgLib.db |
Older or parallel candidate source for message history | compare schema with iSphere DB |
| Local communication logs | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log; zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log; zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log |
Candidate execution trace for message receive/save behavior | inspect log structure and timestamp alignment |
| Login/info logs | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log |
Candidate account/session context for source mapping | inspect field names and account identifiers |
| Received/document cache | zyl\importal\256914c029af44bd96665abd69ddd500\*.xlsx; zyl\importal\4a33b65a33c14149b440724bfc3d912e\g.docx; zyl\importal\4fa0846abdbb4331a956cb056be9566a\*.pdf |
Candidate file receive/download cache for isphere_receive_files |
map hashed directories to DB/log references |
MsgLib.db candidates
| Priority | Modified time | Size bytes | Archive path | Notes |
|---|---|---|---|---|
| 1 | 2026-07-07 15:41:45 | 2,839,552 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db |
latest visible iSphere DB and matches same-day logs |
| 2 | 2022-04-24 08:52:20 | 2,776,064 | zyl\Impp\Account\90005981\MsgLib.db |
parallel/older DB for same account id |
| 3 | 2022-01-25 09:51:17 | 12,198,912 | zyl\Impp\Account\27091282\MsgLib.db |
largest IMPP message DB, useful for schema comparison |
| 4 | 2026-05-15 17:29:01 | 346,112 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\duyanming0731\MsgLib.db |
recent named-account DB for schema comparison |
| 5 | 2026-06-22 14:03:56 | 333,824 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\mayanlong1912\MsgLib.db |
recent named-account DB for schema comparison |
| 6 | 2026-06-25 10:59:33 | 69,632 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\xuguopeng101X\MsgLib.db |
recent named-account DB for small-schema comparison |
| 7 | 2025-06-20 17:37:32 | 239,616 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\zhangzhenghu2730\MsgLib.db |
message DB candidate |
| 8 | 2025-10-23 15:10:42 | 204,800 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\maxiaojie7418\MsgLib.db |
message DB candidate |
| 9 | 2024-01-27 19:17:55 | 206,848 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\dumei0466\MsgLib.db |
message DB candidate |
| 10 | 2025-10-10 17:14:12 | 108,544 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90016309\MsgLib.db |
numeric-account DB candidate |
| 11 | 2025-10-28 09:49:12 | 75,776 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90017948\MsgLib.db |
numeric-account DB candidate |
| 12 | 2023-03-31 15:09:48 | 394,240 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90003887\MsgLib.db |
older numeric-account DB candidate |
| 13 | 2022-06-14 14:54:19 | 282,624 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005184\MsgLib.db |
older numeric-account DB candidate |
| 14 | 2025-06-18 14:07:17 | 191,488 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\lixing0316\MsgLib.db |
message DB candidate |
Same-day account 90005981 log candidates
| Log family | Modified time | Size bytes | Archive path | Why it matters |
|---|---|---|---|---|
LoginInfo |
2026-07-07 15:30:05 | 750 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log |
account/session context for the latest DB |
SaveToDB |
2026-07-07 15:30:09 | 9,704 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log |
trace of persistence into local DB |
PacketReader.ProcessPacket |
2026-07-07 15:41:45 | 244,606 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log |
packet processing trace near DB timestamp |
Smark.SendReceive |
2026-07-07 15:43:08 | 827,884 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log |
send/receive trace near DB timestamp |
Default |
2026-07-07 15:33:47 | 98,056 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Default\2026-07-07_1.log |
general client runtime context |
Default/ErrorFaltal |
2026-07-07 15:32:51 | 57,408 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Default\ErrorFaltal\2026-07-07_1.log |
error/runtime context for the same date |
Received/document cache candidates
The archive contains hashed zyl\importal\<hash> directories with document-like files. The visible examples include:
| Archive path pattern | Observed file type | MCP relevance |
|---|---|---|
zyl\importal\256914c029af44bd96665abd69ddd500\*.xlsx |
spreadsheet | candidate received-file cache |
zyl\importal\4a33b65a33c14149b440724bfc3d912e\g.docx |
Word document | candidate received-file cache |
zyl\importal\4fa0846abdbb4331a956cb056be9566a\*.pdf |
candidate received-file cache | |
zyl\importal\69003b4a95b5461fbe6fba38de74bc62\*.doc |
Word document | candidate received-file cache |
zyl\importal\c4f11655e8d24e96b3a0eb2e3727bba0\*.docx |
Word document | candidate received-file cache |
zyl\importal\cd0cd63034824bbaa81e1136da9dc236\*.pdf |
candidate received-file cache |
These hashed directories become useful after the DB/log inspection identifies message attachment or file-cache references.
First extraction target list
| Priority | Archive path | Destination under runs | Reason |
|---|---|---|---|
| 1 | zyl\iSphere\8c5e81a7f6dd1169.10083\27000000\Account\90005981\MsgLib.db |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-isphere-90005981/ |
latest visible iSphere message DB candidate |
| 2 | zyl\Impp\Account\90005981\MsgLib.db |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-impp-90005981/ |
compare older or parallel IMPP DB candidate |
| 3 | zyl\Impp\Account\27091282\MsgLib.db |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/msgdb-impp-27091282/ |
largest observed message DB for schema comparison |
| 4 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\Smark.SendReceive\2026-07-07_1.log |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-smark-90005981-20260707/ |
message send/receive trace candidate |
| 5 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\SaveToDB\2026-07-07_1.log |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-savetodb-90005981-20260707/ |
DB write trace candidate |
| 6 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\PacketReader.ProcessPacket\2026-07-07_1.log |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-packetreader-90005981-20260707/ |
packet processing trace candidate |
| 7 | zyl\importal\localcache\8c5e81a7f6dd1169.10083\27000000\Log\90005981\LoginInfo\2026-07-07_1.log |
runs/offline-evidence-intake/zyl-qqfile-20260709/extracted/log-logininfo-90005981-20260707/ |
account/session context candidate |
Stage B2 questions
- What are the table names and column names inside
MsgLib.db? - Which tables contain message body, sender, receiver/conversation id, timestamp, and attachment/file references?
- Are contact and group display names stored in the same DB or only inferable from conversation/message rows?
- Do
SaveToDBandSmark.SendReceivelogs reveal DB table mapping or message ids that can be matched toMsgLib.db? - Which DB/log field maps to the
docs/mcp-core-tools-contract.mdoutput forisphere_receive_messages?
Decision after index
Proceed to docs/source-discovery/capability-source-matrix.md after the first extraction target list has confirmed message DB and log candidates. The likely first Stage C implementation slice is isphere_receive_messages backed by zyl\iSphere\...\Account\90005981\MsgLib.db, subject to schema inspection.