±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 1 Overall: 29529
New Yesterday: 4 Visitors: 80

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

Subscribe to news

Subscribe to forums

Voxer texts....

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 

Voxer texts....

Post Posted: Mon Nov 26, 2012 11:03 am

Anyone have any luck extracting Voxer texts from an iPhone 4S yet?

Have a rather sensitive case involving an iPhone 4S.


Ptl. Bob Couchman
Madisonville Police Department
Kentucky Internet Crimes Against Children Task Force
Electronic Crimes Investigator  


Re: Voxer texts....

Post Posted: Tue Nov 27, 2012 10:36 am

What have you tried so far? What software have you used to perform an extraction more generally? Do you have any files in the Application's folder?  

Senior Member

Re: Voxer texts....

Post Posted: Thu Nov 29, 2012 9:29 am

Hey everyone,

I bumped at the Voxer App as well. But I'm not interested in the text messages, but in voice recording from the Push to Talk app. It seems that is not a typical audio codec. At least VLC doesn't recognize it. On their homepage http://voxer.com/legal/proprietarynotices they are listening
Voxer® Proprietary Notices and Third Party Licensor Notices, Disclaimers and License Requirements

I've found there the Skype audio codec SILK listed. But after doing research on Silk I've found out that it's not the SILK codec but something else. It has to have #!SILK\n as header information. I didn't find this header on my files.

Does anybody have an idea how to play that voice record files?  


Re: Voxer texts....

Post Posted: Thu Nov 29, 2012 9:44 am

What header did you have on your files?
Colin Mortimer

Senior Member

Re: Voxer texts....

Post Posted: Fri Nov 30, 2012 6:58 am

there is the folder Documents\Messages\. There are more than 100 sub-folders with message_ as prefix i.e
message_1341678560945_0866591922_3abba19 or

i've figured out
1341670699412 is unix-time formated, confirmed with the creation timestamp of the folder
0287941589 don't know yet
2b3b730 there are several folders with this suffix. could be parts of one conversation which belong together

inside this folder are two or three files and a subfolder named parts
"END" size 0
"journal" with this content 17589:7800
"header.json" with this content: (XYZ, ABC and MySubject are replacements for real names)

the subfolder "parts" has always only one file named 0. the size of 0 varies from 10kb to 150kb, mostly less than 100kb
here are the header of some the files "0". the values in brackets differ
04 [31 64 0A] 20 20 20 20 20 20
04 [31 62 0A] 20 20 20 20 20 20
04 [31 35 0A] 20 20 20 20 20 20
04 [66 0A 20] 20 20 20 20 20 20

thats all I have figured out for now. I appreciate more given hints.  


Re: Voxer texts....

Post Posted: Fri Nov 30, 2012 7:54 am

The most relevant part seems to me the "header.json".
From the (very, VERY little) I know JSON:
is a sort of XML , a kind of "descriptive" language (and "container"):

I would try to find a JSON parser capable of correctly reading the "textual" part, first thing.

See if this fits:

- In theory there is no difference between theory and practice, but in practice there is. - 

Senior Member

Re: Voxer texts....

Post Posted: Fri Nov 30, 2012 1:45 pm

If you want a free json viewer try Allan Hay's site www.ash368.com/#/os1/4547935104

ADF Solutions - Leaders in Digital Forensic Triage
Resources for Forensic Practitioners

Senior Member
Reply to topicReply to topic

Share this forum topic to encourage more replies

Page 1 of 2
Go to page 1, 2  Next