Apologies for the dreaded time and dates question, but I'm drawing a puzzler on this one.
I have a Blackberry 9720 (Released in 2013)
I have extracted from a logical download several PDF files. Some from the phone and some from the memory card (imaged separately)
I'm getting lots of conflicting information from the file data.
Two of the docs are reporting a modified date of 2006. (but others are reporting correct dates as per expected from the job)
However, ALL PDF documents from the phone are ONLY reporting modified dates and no created or accessed.
BUT the recovered from the memory card (that appears to be formatted in the device) are ONLY reporting Created dates and no modified or accessed.
I've used CelleBrite to do my extraction of the handset. I'm confused as the why I'm getting one date from the phone and one from the memory card and where is the random 2006 coming out of?
At best I can think that maybe the time was wrong on the device for two of the documents and then it was set when the others were put on there/downloaded. Or its CelleBrite reporting issues.
Has anybody had any dealing with Blackberry / RIM? Are they approachable for questions like this?
Any other clues or thoughts, I'm open to all avenues!
Thanks as always.
Were these PDFs attachments to emails? I've seen weird time stamps in those situations.
From what I've got from the download there are no email artefacts recovered. At best these documents were simply downloaded from somewhere, but there is no web history recovered. The support for these devices is extremely limited so being able too see what the device has done is a big issue.