UFED Missing body o...
 
Notifications
Clear all

UFED Missing body of messages in iphonerecentlogs

5 Posts
5 Users
0 Likes
3,095 Views
(@kmolden)
Posts: 3
New Member
Topic starter
 

Hi,

I have a UFED extraction of an iPhone 5S, iOS 8.4.1. I am interested in communication between the suspect and the aggrieved. On the day of the murder I know that there was several messages sent from the aggrieveds phone, which the suspect received as iMessages (iPhone 6).
On the aggrieveds phone the messages in question looks to be located in the folder SMS Messages - Uncategorized - iPhoneRecentsLog. However, all messages in this folder are missing data in the Body tab, i.e. i cannot see the message for any of these items.

I cannot find any information on iPhoneRecentsLog, can anyone tell me where this information comes from and if there is a way of decoding the body of these messages?

The phone was extracted (Apple Advanced Logical) and decoded using UFED PA 4.4.0.77.

All the Best,
Katrine

 
Posted : 18/11/2015 4:41 pm
(@agolding)
Posts: 31
Eminent Member
 

Hi,

I have a UFED extraction of an iPhone 5S, iOS 8.4.1. I am interested in communication between the suspect and the aggrieved. On the day of the murder I know that there was several messages sent from the aggrieveds phone, which the suspect received as iMessages (iPhone 6).
On the aggrieveds phone the messages in question looks to be located in the folder SMS Messages - Uncategorized - iPhoneRecentsLog. However, all messages in this folder are missing data in the Body tab, i.e. i cannot see the message for any of these items.

I cannot find any information on iPhoneRecentsLog, can anyone tell me where this information comes from and if there is a way of decoding the body of these messages?

The phone was extracted (Apple Advanced Logical) and decoded using UFED PA 4.4.0.77.

All the Best,
Katrine

This comes from the recents database I believe, it just stores information about recent communication but doesnt actually store the message content.

 
Posted : 18/11/2015 7:30 pm
(@adamrog)
Posts: 4
New Member
 

In my experience with UFED Physical analyzer, when I cant find a certain message, I look in the sms.db database. It holds more messages than the chat/SMS messages tab. Try that and see if you can find what you're looking for.

 
Posted : 18/11/2015 9:44 pm
(@jzbikowski)
Posts: 1
New Member
 

This is taken directly from Cellebrite in a topic called 'What is ‘iPhoneRecentLog’ in Physical Analyzer?'

"This is new data that Cellebrite has added from a database which stores all the latest text communications of the phone.
This table contains notifications for locations, outgoing SMSs (no trace for incoming SMSs), outgoing and incoming emails.
It does not contain the SMS or email body, rather just provides an indication.
It also shows locations."

If you've noticed the email tab re-appear from iPhones this data comes from the same resource.

I've seen a few instances with deleted messages having date/times but not who they were to, so it can be helpful there, or in matching up what communication may have happened when there are gaps in rowIDs from the SMS.db

 
Posted : 24/11/2015 8:59 pm
(@deltron)
Posts: 125
Estimable Member
 

Hi,

I have a UFED extraction of an iPhone 5S, iOS 8.4.1. I am interested in communication between the suspect and the aggrieved. On the day of the murder I know that there was several messages sent from the aggrieveds phone, which the suspect received as iMessages (iPhone 6).
On the aggrieveds phone the messages in question looks to be located in the folder SMS Messages - Uncategorized - iPhoneRecentsLog. However, all messages in this folder are missing data in the Body tab, i.e. i cannot see the message for any of these items.

I cannot find any information on iPhoneRecentsLog, can anyone tell me where this information comes from and if there is a way of decoding the body of these messages?

The phone was extracted (Apple Advanced Logical) and decoded using UFED PA 4.4.0.77.

All the Best,
Katrine

Check Chat or sms you should be able to find the message, recent log doesn't store the body.

 
Posted : 25/11/2015 2:04 am
Share: