I have a Blackberry GSM SQW100 Passport that was acquired using Cellebrite PA. There are several text messages of high importance and dates and times are critical. I am in the US Central Time Zone and have applied the time zone setting within Cellebrite. All of the entries are off by exactly 6 hours (-12 hours UTC which isn't a time zone). I know this because of the context of the messages along with matching up AT&T's records that we received by serving a subpoena for them. Other than the device time being set incorrectly, what other possibilities am I looking at?
Thanks in advance for your help and thoughts.
I don't know about that phone but at one time, Blackberry used a very odd time format
2 byte Time
5 bits for hours, 6 bits for minutes, and 5 bits for seconds.
Interesting. This particular model is not that old and considering that here in the US, Blackberry has virtually no market share there is less information floating around about how they work. I appreciate the reply.
As watcher mentioned, the older BBOS timestamps were a little different. Lots of info here from a presentation by Shafik Punja
https://
The passport however should be running BB10, not the older BBOS and as far as I can remember the timestamps for SMS are stored in Unix Epoch so I'm not sure what's happening here.
What happens if you look at the messages.db manually? Curious if it's stored the same or if PA is converting it twice on you.
Jamie
Thanks for the suggestion.