Verizon Messenger A...
 
Notifications
Clear all

Verizon Messenger Application from Verizon Tablet

7 Posts
4 Users
0 Likes
1,060 Views
steveyo412
(@steveyo412)
Posts: 15
Active Member
Topic starter
 

I've had an Verizon Ellipsis 8 (model QTAQZ3) tablet for over a year now (luckily there hasn't been much urgency with the case). There are thousands (and I mean thousands) of text messages between two parties that are located within the Verizon Messenger application on the device that neither AXIOM or Cellebrite have been able to extract. Both software(s) support the device and both software(s) have support for the Verizon Messenger application. I have been slowly conducting a scroll analysis of the messages, but it is obviously not ideal. Any thoughts or insight is greatly appriciated!

Thanks!

 
Posted : 08/04/2020 6:08 pm
(@mcman)
Posts: 189
Estimable Member
 

What kind of extraction do you have? Is it a full physical/file system dump with all the data or just an ADB backup/provider data? Not sure if the Verizon Messages db gets backed up or not. Can you confirm the message.db is in the extraction? I would first confirm that you did an acquisition that got the relevant data you need then we can see why it's not picking it up as an artifact.

Jamie McQuaid
Magnet Forensics

 
Posted : 08/04/2020 6:17 pm
kastajamah
(@kastajamah)
Posts: 109
Estimable Member
 

Did you do all the extractions that are available for the device (physical, file system, logical, etc)? I have found that if a physical is not available, but I do a file system and a logical, I usually find what I am looking for.

 
Posted : 08/04/2020 7:47 pm
steveyo412
(@steveyo412)
Posts: 15
Active Member
Topic starter
 

I have successfully extracted the data with Cellebrite UFED 4PC by ways of a logical and file system (physical supported but failing). Neither have the Verizon messages. The tablet does have and SD card, and when navigating the extraction it appears the Verizon Messages App is stored on the SD card, but the database file itself isn't being extracted.

 
Posted : 10/04/2020 11:55 am
(@mcman)
Posts: 189
Estimable Member
 

I have successfully extracted the data with Cellebrite UFED 4PC by ways of a logical and file system (physical supported but failing). Neither have the Verizon messages. The tablet does have and SD card, and when navigating the extraction it appears the Verizon Messages App is stored on the SD card, but the database file itself isn't being extracted.

Logical won't have it since that's mainly just provider data. File system extraction will depend on the type of file system extraction as they vary with Cellebrite from a simple ADB backup or a full privileged file system dump (I'm guessing it's just an ADB backup with the SD card based on your comment). An ADB backup won't have it as I think you've discovered since the database isn't there.

So in short, you won't get those messages until you get a better extraction. Either an actual file system dump (not a backup) or a physical collection will likely be necessary. I'm not sure what other extraction options are available to that device b/c I've never looked at it before but given it's from Verizon, I'm guessing locked bootloader will prevent a few of the more common options.

Hope that helps,
Jamie

 
Posted : 11/04/2020 2:34 pm
(@tackleberry)
Posts: 30
Eminent Member
 

I had this on gal S7. I could see the sms within verizon messenger , but cellebrite did not decode. I was able to find messages within database tables. I submitted the case to cellebrite and last advised they should be able to add the app into R &D. Haven't checked that old dump to see. did you try it in any other software package?

 
Posted : 08/05/2020 8:39 pm
steveyo412
(@steveyo412)
Posts: 15
Active Member
Topic starter
 

@tackleberry Cellebrite and AXIOM - no luck

 
Posted : 19/05/2020 6:23 pm
Share: