SMS timestamps in N...
 
Notifications
Clear all

SMS timestamps in Nokia PM

7 Posts
4 Users
0 Reactions
1,278 Views
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
Topic starter  

Hello everyone,
i'm working on an Xgold chipset based nokia phone.

i have a PM absolute dump of the phone, and i was able to reconstruct the PM filesystem structure.

I've located SMS messages in PM 52, and to what i could understand
the SMS structure is like this

[52]
0=………. # SMS text in unicode
1=………. # SMS metadata sent/received, party number, timestamp and SMSC

most of the metadata are easy to reconstruct, but i have serious issues in understanding the timestamp.
does anyone know how the SMS timestamp is defined in PM memory? it's expressed in 4 bytes but i can't get it to decode.

any help would be really apreciated.
thanks


   
Quote
 RonS
(@rons)
Reputable Member
Joined: 17 years ago
Posts: 358
 

Can you send few samples of these 4 bytes

Ron


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
Topic starter  

of course

98 BC C4 BC
21 88 C4 BC
59 11 C5 BC


   
ReplyQuote
(@trewmte)
Noble Member
Joined: 19 years ago
Posts: 1877
 

Rampage, appreciate Ron is looking at your issue, but not sure whether you had the time to look at Paul Sandersons webpage for some tips

http//sandersonforensics.com/forum/content.php?131-A-brief-history-of-time-stamps


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
Topic starter  

Thank you for the link, i'm looking at it right now )

of course i'm thankful to everyone who is helping me out )


   
ReplyQuote
(@polar)
Eminent Member
Joined: 15 years ago
Posts: 48
 

of course

98 BC C4 BC
21 88 C4 BC
59 11 C5 BC

The epoch is 2050. Therefore 59 11 C5 BC = -1127935655 = 5 April 2014 43225


   
ReplyQuote
(@rampage)
Reputable Member
Joined: 17 years ago
Posts: 354
Topic starter  

Thank you Polar!


   
ReplyQuote
Share: