I have found a lot of SMS files in the system\vendor\message\sms\phone on an INQ1. (from PSAS)
The screen is damaged on the handset and cant get a read with UFED or XRY. Does anyone know how the time and date is stored in these file? and where and what the flags are for sent/recieved/read/unread?
Also is the a way of automating the decoding process. The text and number appear to be in Unicode.
Thanks
If i remember rightly BREW based handsets often use a 32bit epoch date format (seconds since 1980/01/06). Numbers should stored little endian.
I haven't looked at the SMS too much, but regarding reading with UFED/XRY - when you first plug it in it usually tries to install drivers (shows up as a CD drive on your PC) - only once you've run that will it allow you to connect - it also might be waiting to be put into PC Suite mode? (Think it's the default option, so you might just need to click "yes" - but don't take that as gospel by any means!)
Excellent work on the time and date, thanks AlexC.
Anyone have any ideas on the flags?
Do you have any "you recieved a missed call" type message in there - not "totally scientific", but that's almost certainly incoming! Might be woth getting hold of one though - quite a few on ebay http//