Hello all,
We have a dump from a Nokia Lumia 925 via JTAG, and have parsed the 28 file system partitions using FTK.
The aim is to recover call logs and text messages (saving ourselves from taking 100s of photographs!).
We have managed to recover the call logs from the ‘phone’ database in the following location-
\Users\WPCOMMSSERVICES\APPDATA\Local\UserData\.
As for the text messages, we know that these are stored in the ‘store.vol’ database in the following location-
\Users\WPCOMMSSERVICES\APPDATA\Local\Unistore\.
We know that it is an ESE database, and viewing the file in hex confirms that there are text messages available. We have had mixed results using ESE database viewers. The only one that opens the file shows no data in the ‘message’ table.
Has anyone had any success in decoding the store.vol file?
I can try to do it for you. Can you send phone's dump to me?
PB10,
I have sent you a private message.
Best regards,
Ron
Thanks for the replies. I will PM you both so i can get the files sent over to you.
I have managed to find a database viewer (from OS Forensics) which opens the Store.vol file. The messages are viewable in the 'message' table, and they can all be exported to a CSV file.
Obviously, automated decoding of this file would make life easier (with decoding of deleted data too). I hope this helps. D