Recovering deleted ...
 
Notifications
Clear all

Recovering deleted iMessages from iPhone5? Spotlight sees it

8 Posts
4 Users
0 Likes
742 Views
(@john_smith)
Posts: 13
Active Member
Topic starter
 

UFED Ultimate pulls the logical data from an unlocked iPhone 5 well enough and the data is parsed in Physical Analyzer and all looks good.

Except if I grab the phone and do a spotlight search via iOS (6.1) and enter a keyword, in this case 'molest" and "sex". Multiple message previews are shown that are not present in the parsed logical image, at least as far as I can tell.

Is there a way to get these iMessages?

 
Posted : 14/09/2013 3:21 am
(@john_smith)
Posts: 13
Active Member
Topic starter
 

For giggles I went through a friends iPhone 4 and via spotlight search I am able to see message fragments almost a year old, long deleted. This phone has never been backed up to iTunes, only iCloud.

 
Posted : 14/09/2013 11:35 pm
(@alexc)
Posts: 301
Reputable Member
 

Spotlight maintains a separate index of SMS messages. I can't remember if the this file comes down on a backup or whether you'll need a more "physical" extraction, but the file (SQLite database, naturally) should be in

mobile/Library/Spotlight/com.apple.MobileSMS
You get the message text, and sometimes a date. You don't get a straight phone number, but there's a field which contains identifiers which you might be able to reconcile with the SMS database.

 
Posted : 16/09/2013 12:09 pm
(@john_smith)
Posts: 13
Active Member
Topic starter
 

Thanks I'll take a look.

 
Posted : 17/09/2013 7:34 pm
(@john_smith)
Posts: 13
Active Member
Topic starter
 

Appears the /Library/Spotlight is not part of the logical data. Did an EnCase logical and it doesn't see this database either.

 
Posted : 17/09/2013 8:29 pm
(@hamiltoncharles)
Posts: 1
New Member
 

If you want to recover from iTunes or iCloud, go to http//support.apple.com/kb/HT1766

If you want to recover deleted imessages quickly and safely, you can try some recovery apps.

 
Posted : 02/06/2015 7:48 pm
ForensicMeteor
(@forensicmeteor)
Posts: 60
Trusted Member
 

Jailbreak the iPhone. After that, run a file system extraction and choose the "jail break" selection. (Cellebrite) You should be able to grab the spotlight database.

 
Posted : 16/06/2015 8:44 pm
ForensicMeteor
(@forensicmeteor)
Posts: 60
Trusted Member
 

You can also retrieve iMessages from iChat archives on Mac devices.

 
Posted : 29/07/2015 2:04 am
Share: