iOS Forensics: Dele...
 
Notifications
Clear all

iOS Forensics: Deleted 'messages'.

4 Posts
4 Users
0 Likes
2,064 Views
(@forensicitderby)
Posts: 18
Active Member
Topic starter
 

Hello,

Deleted messages on the iPhone/iPad - be it iMessages or SMS Messages, do they get over-written at some point on the device when they are deleted? - Or do they remain on the device when they have been deleted and never get over written unless the device is erased and restored?

If they get over-written then does this apply to the 'Messages' that get sent up to iCloud?

Would deleted messages be included with the iCloud backups?

No particular reason for wanting to know, just wanting to clarify.

Thanks.

 
Posted : 21/10/2015 6:52 pm
(@v-katalov)
Posts: 52
Trusted Member
 

As far as I know, these messages are stored in a database in the SQLite format. SQLite does not remove things immediately; instead, deleted records are placed into so-called 'freelists'. They can be recovered with proper tools if you are able to extract the actual database file. Eventually, they get overwritten with new data (new SMS/iMessages). SQLite's default behavior is also performing a full commit every 1000 records, so after that many new writes the freelists will be cleaned.

In other words, deleted messages won't stay there forever, but they won't be erased immediately either.

The messages (including deleted records) are naturally saved into iCloud and/or iTunes backups, so you can use forensic tools to retrieve them from the freelists.

 
Posted : 22/10/2015 5:02 pm
(@belkasoft)
Posts: 169
Estimable Member
 

Belkasoft offers a tool which, among other functions, can recover deleted messages from freelists and SQLite unallocated space. You can try it free at http//belkasoft.com/trial.

You can also read our article on SQLite http//belkasoft.com/en/sqlite-analysis

 
Posted : 23/10/2015 1:14 am
(@Anonymous)
Posts: 0
Guest
 

Above all, if you have backed up iPhone in advance, you can restore deleted text messages from iTunes or iCloud backups.

 
Posted : 21/08/2019 1:51 pm
Share: