• chatmsg<number>.dbb files contain chat messages
• callmember<number>.dbb files contain call history

The number specifies the size of a record. Small messages fit in 256, when a larger record is needed, chatmsg512.dbb is created and so on.

The first messages content in a conversation just contains the name of the person who started the conversation. I will call such messages “introduction-messages” in the following.

All Strings are 0-terminated, maybe even double-0-terminated.

• 4 Bytes Identifier, “l33l”.
• 2 Bytes Record length (maybe not limited to 2 bytes variable size)
• 2 Bytes NULL
• 2 Bytes Message number (maybe not limited to 2 bytes variable size)
  This shows in which order messages where received. It is more precise than timestamp, which is seconds-based.
  Also, this seems to be more a event number, as it is globally unique (chats, call history)
• Unknown; ending with 0x03E003
• chatname, a unique identifier of the session;
• 7 Bytes Timestamp (described in http://www.lpcforensic.it/public_html/yabbfiles/Attachments/SkypeLogFileAnalysis.pdf)
• Unknown; ending with 0x03E803
• Sender-ID (skype-id)
• Unknown; ending with 0x03EC03
• Sender-Name
• something ending with 0x03FC03 or 0x03F403
• the Message content
• something ending with 0x03D818 or 0xf10303,
  if the latter:
  something ending with 0x03D818
• Chat members

Not all messages are formatted like this between Sender-Name and Chat members. However, those are only introduction-messages as far as I can see (which can be ignored anyway)

Very similar:

• 4 Bytes Identifier, “l33l”.
• 2 Bytes Record length
• 2 Bytes NULL
• 2 Bytes Message number
• Caller-ID
• something ending with 0x039c07
• Caller-Name
• something ending with 0x03b801
• 2 Bytes unknown
• Timestamp as string; Unix-like: seconds since 1970-01-01 00:00:00 UTC
• unknown

Hidden somewhere should be the call duration.

• Skype History Access
• http://www.lpcforensic.it/public_html/yabbfiles/Attachments/SkypeLogFileAnalysis.pdf