iPhone 6, iOS 11.4.1, unlocked, acquire deleted text/SMS?

urq82 · 2018-09-29T06:15:49Z

A client iPhone 6 - A1586 - that hasn't been connected to a PC previously (no iTunes backup) - I have been provided unlock code and 2FA access to the AppleID / iCloud.This is a civil client case (not LE) where the iPhone 6, 16GB, iOS 11.4.1, is believed to contain old deleted text messages (SMS). Internal memory use is almost 100%. The objective is to try to retrieve previously (ca 3 months back in time) deleted text messages. Backup on iCloud exists but storage is also maxed out - 2% free, only two generations of backup shown (recent both).The phone was logically acquired with Magnet Acquire (latest version), resulting in a 8GB file (Apple iPhone7,2 Quick Image.zip). Also tried acquisition using Encase 8.07 and Belkasoft Acquisition Tool (less data was collected by these tools).The files acquired are the backup files (such as 3d0d7e5fb2ce288813306e4d4636395e047a3d28 of the sms.db). These files does not seem to contain any deleted messages though (using SQL-tools to search).Is there a working option to get hold of the sms.db under these circumstances? Is it even likely that the sms.db contains larger numbers of deleted messages (as is the objective to find)? Jailbreaking the phone is possible if it helps the case. Any method that positively would be useful to extract the sms.db? Paid service is an option if offered!Appreciate any help on this issue! I have searched the net and this forum for options - then I decided to post this request instead!Location is Sweden.

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by UnallocatedClusters 4 years ago

11 Posts

8 Users

0 Reactions

3,771 Views

RSS

UnallocatedClusters

(@unallocatedclusters)

Honorable Member

Joined: 13 years ago

Posts: 576

14/10/2021 7:21 pm

Posted by: @zeroonezero

iCloud backups flush database free space?

Has anyone else noticed that recovered deleted iMessages lack content when parsed by Cellebrite?

Our experience has been that Cellebrite does recover deleted messages in which only the message sender and message sent date can be parsed and that upon further analysis of the corresponding portion of the SMS.db file, there is no "body" content to be parsed nor recovered.

Cellebrite Physical Analyzer allows one to view the SMS.db file in hexadecimal and corresponding text. Whenever we see Cellebrite recover only partial text messages of interest, we use PA to analyze the portion of the SMS.db file in the hex/text view to confirm that there was no text message body to be parsed.

I highly recommend this course which covers SQLite database analysis in depth: Cellebrite Learning Center: Cellebrite Advanced Smartphone Analysis (CASA) Course

DISCLAIMER: I do not work for Cellebrite but do use Cellebrite in my practice.

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
245 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed