I am looking for an explanation for why some text messages are stored on the SIM card and not on the device itself. I have a couple of explanations, but wanted to get some other thoughts.
I acquired the data on the phone using UFED Physical and can carve out some of the messages from storage on the phone, but not all
The current phone I am working on is a Samsung SGH-T479
Thanks for the help
Patrickf, there are several reasons
1) the settings in the SMS-delivery type and what is recorded in the mandatory field transport protocol data coding scheme (TP-DCS)
2) if the ME has reached memory capacity
3) the user profiles the ME to use SIM data field first
Sometimes, not always, concatenated messages can be split between ME and SIM dependent on availability of memory capacity. This may be due also to how the handset manufacturer has programmed the message server.
I wrote a piece on SMS 20th Anniversary and mentioned some technical parameters for SMS. One element is relevant to the above specific question
However transfer cases are only one aspect, and when dealing with text messages understanding relevant instructions regarding the storage desitnation for a text messages are defined by Classes (0-3)
Class 0
Class 1 Default meaning ME-specific.
Class 2 (U)SIM specific message
Class 3 Default meaning TE specific
SMS text message investigation doesn't end there as there are other aspects to consider such as the coding schemes used for the text messages, which can influence the maximum length of text messages, thus the user data length of a message. Commonly, the following coding schemes referred to are
http//