If we have the memory card that a supposedly in a blackberry that a voice recording was saved to. Would you say that you would need the original blackberry to examine and not only the memory card in order to determine if in fact the recording is genuine and the blackberry was the original recording device? What else is needed from the blackberry to prove that the card was in fact in the blackberry and used to store the recording? Thanks
I think that there should be a BBThumbs.dat file associated with that folder. It should contain the recording's file name. It could be faked I suppose but it's attention to detail that most people probably wouldn't have methinks.
I agree we do see the BBThumbs.dat file, have a record of every voice recording taken on the blackberry to date?
In the case of Images it certianly contains the details of images no longer present on the handset, so I'd imagine the same could be said for audio - can't confiirm that right now as I don't have a test handset to hand!
you and I both, but when I have previously tested this, I deleted various voice recordings such as how they go in sequence, VN 00001.amr, VN 00002.amr and they did reside in the BBthumbs.dat, but not on the device itself. Would you agree that the device of creation of the voice recording would contain valuable evidence rather then just the memory card the recording resides on. This would allow us to see if previous recordings were made that could have been transferred and edited, etc.
I think in the case of newer models they store the BBThumbs on the memory card, in the folder it refers to (if the files were indeed originally on the memory card.)