We have a unknown model blackberry coming in on Tuesday that had SMS data on from January that has gone missing. (users words)
All the SMS before and after are still available but Jan can not be viewed.
We cant get access to the Blackberry server (thoughts are that the IT department may have caused the data loss). I've been around the options and its a firm NO at this stage.
The task I have is to attempt recovery of the Jan SMS data and currently I'm struggling to work out a starting point.
Any thoughts/advise welcomed.
Best regards,
Jason.
Correct me if I am wrong, but with a blackberry, once it's deleted, it's gone! If you can retrieve deleted SMS's from a Blackberry, I want to know HOW you did it! You could make a fortune!
Ok SMS is usually handled by the mobile network operator rather than the blackberry server, normally the blackberry server handles the email. It is probably easy enough to not distinguish what are emails and what are SMS etc on one of these devices.
Just on the off chance does the user ever back up their Blackberry? As you may be able to read/recover the messages from the backup file. The backup file would be on the computer they use to back up rather than the handset itself. There are some programs available that will enable you to read these back ups.
Also they may possible have moved the messages to a folder or have it set to only view so many messages etc. So you could check this in the handset as well.
Forgive the statement of the obvious - but don't forget to examine the SIM card in isolation. It is unlikley but you never know there could be SMS and even deleted SMS on there?
Has the user backed up their blackberry using BB desktop?
We had a case where the user backed up regularly and the .ipd files were saved on their computer.
Analyzing those .ipd files in BK Forensics CPA and using ABC Amber Blackberry, we were able to piece together our investigation, recovering a lot of what were once thought to be deleted sms and emails…
Just a thought..