Decryption of a zoomus.enc.db database

Hi,

I've been trying for a couple of weeks to (unsuccessfully) decrypt a zoomus.enc.db. Axiom and other forensic tools have failed to decode, even after providing the password for the user.

I found an earlier post on the topic here:

[https://www.reddit.com/r/computerforensics/comments/kch7ot/zoom\_artifacts\_encrypted\_dbs/](https://www.reddit.com/r/computerforensics/comments/kch7ot/zoom_artifacts_encrypted_dbs/)

From my understanding of this post, the Zoom.us.ini file contains a base64 encoded string, which must be decoded into binary and then unprotected using DPAPI. This is the key that is used to decrypt the database using SQLCipher.

My …

axiom base64 computerforensics database decode decrypt decryption file forensic forensic tools found password tools topic understanding zoom