±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 13
Overall: 26959
Visitors: 64

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Editing iPhone SMS messages

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Editing iPhone SMS messages

Post Posted: Mon Feb 11, 2013 5:55 pm

I'm reviewing a case where Subject A (supervisor) sent Subject B (employee) threatening job-related text messages. Subject A admits to sending Subject B text messages, but states the text messages were edited, and were not her exact words. Subject A was not willing to consent to a search of her text messages. All we have is Subject B's iPhone 3.


I have researched this matter and have located ways to access sms.db and edit/delete messages, but only when the phone has been jailbroken. Is it possible to edit messages w/o the phone be jailbroken?  

sward6
Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Mon Feb 11, 2013 9:56 pm

I can think of two things to test.

1. Backup phone, unpack backup and edit sms.db, restore phone.
2. iphone explorer may provide you access to write to the file system but im not sure

other than that, unless its jailbroken id imagine its harder to edit the texts. can you get the other phone used in the conversation?  

randomaccess
Senior Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Tue Feb 12, 2013 5:40 am

- randomaccess

2. iphone explorer may provide you access to write to the file system but im not sure


I'm pretty sure that unless the device has been jailbroken there is no way to mount the device and access this location using a file explorer.
_________________
Colin Mortimer
AirWatch 

Coligulus
Senior Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Tue Feb 12, 2013 12:16 pm

- randomaccess
I can think of two things to test.

1. Backup phone, unpack backup and edit sms.db, restore phone.
2. iphone explorer may provide you access to write to the file system but im not sure

other than that, unless its jailbroken id imagine its harder to edit the texts. can you get the other phone used in the conversation?



No - the other half is not willing to give up their cellular telephone (I wonder why??).

I guess my follow-up question would be, if extracted via Cellebrite, and the software version is iBoot-931.71.16, that would indicate it has not been jailbroken, correct? I've never come across a jailbroken file extraction.  

sward6
Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Tue Feb 12, 2013 3:44 pm

quickest way to tell is look for cydia on the phone.
other than that i havent had much to do with jailbreaking  

randomaccess
Senior Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Wed Feb 13, 2013 4:48 am

Don't rule out the simple option that the recipient of the threatening messages may have saved their own number under the senders name. They could then have written the messages to them self. The handset would present them in both an incoming and outgoing format. The person could then delete the duplications and it would look like a conversation with that named person.

Obviously I haven't seen the device so can't comment on what is there. Just thinking of ways someone might make it appear that they had received texts that they may have not. Given the attitude of the person who supposedly did the sending, it sounds fairly suspicious.  

TomP
Member
 
 
  

Re: Editing iPhone SMS messages

Post Posted: Wed Feb 13, 2013 11:31 am

- TomP
Don't rule out the simple option that the recipient of the threatening messages may have saved their own number under the senders name. They could then have written the messages to them self. The handset would present them in both an incoming and outgoing format. The person could then delete the duplications and it would look like a conversation with that named person.

Obviously I haven't seen the device so can't comment on what is there. Just thinking of ways someone might make it appear that they had received texts that they may have not. Given the attitude of the person who supposedly did the sending, it sounds fairly suspicious.



I've already confirmed the messages were sent from the suspect. The sent/received messages matched the times that AT&T had listed on their text log for the victim's phone number. Plus the suspect admitted to sending the messages, they are just stating that the messages had been edited after the message was received.  

sward6
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next