CLOSED: Advice needed for an ongoing criminal case

You can try making a video recording of the phone's screen as you manually scroll through the messages of interest. You can then give the video file to the police and maybe they can use that as evidence. Ideally the police themselves should do all this stuff. In any case the phone containing the messages should not be used / turned off until the matter is finalised.

You need to establish if the phone is one of those supported by software such as Paraben's Device Seizure.

If not, then the texts will not be recoverable from the phone's main memory, although recovering deleted texts from a SIM card is straightforward. However, phones tend not to store many texts on the SIM card.

I went through exactly the same scenario (in practically every aspect, although the victim was 16 years old) but because the phones (Nokia N95 and some other, obscure model) weren't supported by any of the forensics seizure utilities, no data could be extracted from them.

I hope something can be done - my heart goes out to your friends.

If you could supply the make and model of the unit, i will advise the best course of action. I am based in the UK and have several years experience dealing with digital forensics for both law enforcement and commercial organisations. My main specialism being mobile phone forensics.

In the first instances it is essential that the mobile phone including SIM card are isolated (no radio covergae and usage permitted). Switch off and if possible seal the item in a tamper proof bag/box noting details.

There are several tools on the market that will allow logical acquisition of stored data from both the SIM and handset inlcuding memory cards if applicable for example, Phonebase II, GSM XRY, Cellbrite UME 36 Pro, SIMIS, USIM detective etc.

I do not know of any firms in NZ or Australia however if you could supply the make and model i will pass on to my contacts in an attempt to identify possible practitioners in your area.

Hope this is of assistance.

You can PM me @ vinnyparmar@yahoo.co.uk.

You can try making a video recording of the phone's screen as you manually scroll through the messages of interest. You can then give the video file to the police and maybe they can use that as evidence. Ideally the police themselves should do all this stuff. In any case the phone containing the messages should not be used / turned off until the matter is finalised.

One of the downsides of an open forum such as this is that you get advice whihc is sometimes totally innapropriate and could destroy your case - taking the above at face value is one of them. There are occasions where the advice quoted above may be necessary but they are very few and far between. Doing the above, and in particular doing it yourself, would likely destroy the usefulness of any evidence that you do obtain (which would be limited as you have alreayd stated that the message has been deleted).

Both open and closed forums have their place, but perhaps Jamie could put a sticky at the top of the forum about treating any answers to such questions with extreme care.

You should NOT get involved in the technical aspects of this and should find a local company who specialises in this work - why not try contacting one of the computer forensic departments at one of the bigger forces and ask whether they know of any companies that do phone forensics - there should be plenty of them down there.

RedElephant, if you cannot find someone in your country who will do this then I have spoken to the lab and we will offer to image the mobile telephone memory and SIM card free of charge and return the findings.
The offer ends there though. Travelling to NZ is not on offer due to expenditure.

This does NOT mean an offer to others to do free of charge work.

My immediate observations to you is do not play with the mobile or switch in on. Hand the mobile telephone to the police and if the police wish to contact us in the UK then here is my email and web details.

Greg Smith
TrewMTE

trewCO@compuserve.com
http//trewmte.blogspot.com

Thank you to all who replied, particularly trewmte and vinnyparmar. I'm going to wait a couple of days and see what my other inquries turn up, then make a short list of recommendations for the family to consider.

I am certainly with you, sandy771, that this is no time for amateurs. That's why I decided to get recommendations for a specialist/firm, rather than consumer software.

sierraindia, the whole point of my post was that the texts were deleted. If they were still there, it wouldn't be a problem.

We're actually in one of NZ's top 3 cities. Yet, the police didn't even mention phone forensics as a possibility. My friends' growing impression is that they don't take sexual assault cases that seriously—they're not going to spend a lot of resources investigating it.

Suggest you contact

http//www.thackray-forensics.co.nz/home.asp

John Thackray is very experienced in this area and the forensic system they use for mobile phone forensics is well regarded.

Not a good idea to go into too much detail about any case on a forum like this,

Suggest you contact

Not a good idea to go into too much detail about any case on a forum like this,

Just what I was thinking - too much info about the 'victim'.

Great comments from everyone

I am glad that someone finally added that in no way should
Someone who is not qualified and trained attempt to recover such
Data as this could harm the case even more.