.ab files

.ab files are usually logical backups, not something at filesystem level, I don't think you will have much of deleted data in it.

For deleted recovery you need software which can create physical dump of the device, which can be analyzed later on with some good forensic software.

.ab files are usually logical backups, not something at filesystem level, I don't think you will have much of deleted data in it.

For deleted recovery you need software which can create physical dump of the device, which can be analyzed later on with some good forensic software.

I think it is possible as sms is stored in sqlite format and you can still dig up deleted content in that

Dexter,

Please download Autopsy (http//www.sleuthkit.org/autopsy/download.php) which is a free analysis tool that can ingest Android Backup files.

You might also try AccessData's FTK Imager (http//accessdata.com/product-download), another free tool, which may enable you to view the .AB file as a tree of files and folders.

You will then need to search the folders for the SMS containing sqlite database file. You can Google both.

Once you have identified the correct, sqlite database files, then you can move to recovering deleted content.

In terms of carving the sqlite database file for deleted messages, see Paul Sanderson (http//www.sandersonforensics.com/forum/content.php).

Does this help?