I'm working a case involving a Verizon LG (CDMA) VX-9700. The victim stated there were incoming and outgoing SMS messages that would be needed for the case. When I first received the case it was from a neighboring agency and the phones contents had already been downloaded with their UFED. I noticed none of the incoming SMS messages transferred, but the outgoing were present in the report.
I ran it through our departments UFED and the same thing was true. Keep in mind that the inbox for this device is full. I'm somewhat new to the forensics side of things and wanted to know if this is common in some devices? I'm assuming that because the handset's SMS inbox is full that may have something to do with the UFED not pulling the messages?
The incoming SMS messages are on the device so I think worst case is I will be documenting them manually?
Thanks!
It may be that the incoming messages are MMS not SMS. UFED does not get MMS in many cases. I am having a great deal of luck with Final Mobile in getting mms messages that other tools won't get.
Eric
Eric,
Thanks for the response. These are definately SMS messages. I'm just wondering if this has happened to anyone previously and does anyone think that the UFED's inability to extract the incoming SMS messages may be related to the fact that the inbox is full?
I can't speak to the UFED, but before you go the manual route, give Bitpim a try. It works very well with LG CDMA phones, and may grab the SMS for you. If nothing else, you should be able to use it to grab the file system and get the SMS that way.
I remember Final Mobile back in Feb 2009 when pronie2121 referred to this tool and I asked if someone would produce a pros/cons write up about it. I am assuming with the knowledge and experience at this forum Forensic Focus has the influence to influence and encourage others to produce findings and by Apr 2009 the US NIJ produced a report on its tests conducted using Final Mobile.
See the Results Summary starting page 2 of 239.
Eric, has the product moved on since that write up?