As we know that the most popular database on mobile phone is SQLite database. Lots of Apps use SQLite database to store data.
The evidence is iPhone 5s with iOS 9.1 and not jail breaked. I use UFED to do advanced logical extraction just now. All I know is that suspect did use Naver LINE a lot. You guys could take a look at my blog to see what's going on.
http//
Unfortunately I did not recover any deleted LINE chat messages after advanced logical extraction. Only few messages left and those messages have nothing to do with this case. Where are those deleted messages now???
My colleague reminds me that the latest version of Naver LINE is 5.8.0 for iOS. Since LINE 5.3 and above, LINE added a new feature called "True Delete" which means wipe out all deleted chat messages. Finally I realize that's the reason why I could not recover any deleted chat messages extracted by UFED.
Gorvq7222, we deleted several messages in Line v. 5.8.0 on our iOS device and extracted data with Oxygen Forensic Detective. All messages are recovered and shown both in Line section and in SQLite database itself. But nobody can guararntee that you can 100% recover all data from SQLite and sometimes data is really wiped forever. Have you tried several devices with Line?
Thank you OxygenSoftware. Actually I've tired to recover LINE(5.3 and above) deleted messages on both iOS and Android platform. Unfortunately no deleted chat messages found~
I'd like to send you the download link of this LINE SQLite database file as shown in my blog. But I don't have that LINE SQLite database file in hand, I will give you the download link couple days later. Please let me know whether Oxygen Forensic suite could recover deleted messages or not. I can't wait to see the report~
Hi OxygenSoftware,
Sorry for having kept you waiting for such a long time~ I was busy training my clients about digital forensics for 9 days. Now here is the download link for that Naver LINE database I mentioned
https://
Anyone who is interested in whether those deleted chat LINE messages could be found or not also please download this Line.sqlite and take a look. I'd look forward to hearing from you soon.
Yes, this particular sqlite database does not contain deleted messages. Probably there were deleted forever. Maybe much time passed and these deleted records were overwritten with new ones.
Hi OxygenSoftware,
Like I said I was busy training my clients for nine days and I could not go back to my office to get that database file out from ufed case for you. I did not do the extraction again from that iPhone, and actually I just export that database file from ufed case created in the first place this morning, so there won't be no new messages go into that database file.
Thanks for your patient. I'd appreciate your providing me any info you have.