Just be careful when extracting it, the 'Event Log' (where the call register is taken from) is a rolling event log and will delete data as the date/time settings of the handset increase.
Thanks TomP, very useful to know!
Just letting you know you may have problemss in using a USB write blocker for extracting media from a mobile phone as the software often has to send extraction requests up the wire to get the phone to send it. All the best
Steve
Interestingly I previously attempted a little test like this when I used a USB write blocking registry key. First I tested it by trying to write something to a memory stick which failed, great, this is what I expected. I then attempted to extract a handset and this was successful. It was a brief test and purely for interest rather than forensic value, however it suggested to me that commands may well be able to travel to the handset, as long as they are not write commands. I never got around to trying it on a Tableau.
As such, it may well be worth trying the Tableau as you never know until you try. Worst case scenario it fails but nothing has changed on the handset so it's not all bad.
Ok, so I have loaded the phone up in Oxygen Forensic for Symbian OS and it shows everything as it should. However, the problem is the person looks to have deleted the vast majority of the messages. How do I go about recovering it?
I am looking to get a image of the internal memory, as I have processed an image from the Micro SD Card and that went fine. When I load the phone from File Manager I can browse to the phones internal memory using the Nokia PC Suit however , it cannot be accessed via any other program i.e FTK Imager. Also, loading the phone up using Media Manager and the sort does not give me access to it either.
So is there anyway of creating an image from it, and as previously mentioned once imaged does the Symbian OS stop you from reading, say, deleted messages?
Cheers
As far as I'm aware there are numerous papers that have been published on how to gain access to a Symbian partition, however I have not seen one that covers the more modern versions. There is no way currently to get back the deleted SMS (although if anyone can shed some light on a method I am happy to experiment with some test handsets).
If you still have any of the event log intact, you may have some references to old messages in there that are no longer on the device, however this will only display a small part of the start of the message. If the handset has the life blog application on it, there may be some evidence in there. This is dependant on if the device has it installed. I found Oxygen is very good at extracting this in the past, however I have not yet used it on the latest version of Oxygen. You should be presented with some small image files (jpegs I think) that look almost like yellow post it notes with the content of the SMS in them.