oops I am going to start off this post pleading ignorance. I am probably the only one in the world that doesn't text message and haven't to date.
I recieved an inquiry as to whether or not text messages can be retrieved from a cell phone. I a) do not know if they get stored locally or b) if they get stored at a server level somehow.
How does that technology work?
I'm hoping to attend a cell phone forensics class in the near future but I'm not sure who has the best software for this and therefore who would have the better training. (I know, this thread has now officially crossed forums)
Any insight you may be able to provide would be much appreciated.
Thanks,
John
The short answer is yes. The odds of finding them however depend on a great many factors. The messages can be stored either on the phone, on a SIM card, or on the user's computer if they synced the phone.
Some things to consider, how many text messages were sent/received since the conversation of interest? The make and model of phone will be important. Does the phone have a SIM card? That's probably the best place to start if it is. You'll need a SIM card reader and analysis software. In my experience if it's not on the SIM card then it's unlikely to be on the phone's memory either.
I have used Paraben exclusively to this point. I cannot compare it with anything else. There is currently no single solution as such. You just need to find what works best in a given situation.
Hi,
I have been using .XRY ForensicSim Toolkit (FST) and mobiledit, for mobile phone forensics. I think .XRY is really good, it connects and acquires from over 1500 phones. As far as deleted texts are concerned, so far i have only been able to retrieved deleted text messages from the SIM, again FST and .XRY are the best tools for this. But i think to retrieve deleted messages from the handset, you must remove the eeprom from the circuit bored and acquire from it. but this will ruin the phone and you cannot use the phone again.
I have one question, is there any way of finding out SIM details conected to a text message which is saved in the handset?
Imran R. Khan
Forensics Investigator.
Hi,
…
But i think to retrieve deleted messages from the handset, you must remove the eeprom from the circuit bored and acquire from it. but this will ruin the phone and you cannot use the phone again.
…
Imran R. Khan
Forensics Investigator.
As for getting data out of an EEPROM, it depends upon the particular
situation. For the vast majority of electronics, the EEPROM will come
in an 8-pin SOIC and it'll be easy to access the pins. It is NOT HARD
at all to get the data out of it. The vast majority of EEPROMs are I2C
or SPI and the protocol for getting data in and out is completely
standardized. Even the pin assignments are the same across all the
major manufacturers, e.g. Atmel, Microchip, ST microelectronics,
etc.
It'll be best to just cut the power line to the chip (use an xatcto knife
if you're lucky, or if necessary, a small drill since the board likely has
4 layers and pray that you only cut the via to the power plane) and
then use microclips to provide power and ground to the chip, and then
attach two wires for I2C and three wires for SPI. It would take me
very little time to do this with my old laptop and its parallel port, or
I could whip up a small circuit on a breadboard and interface it to a
serial port and a serial to USB adapter.
This stuff is child's play. Anybody whose completed their sophomore
year of a CompE or EE program should be able to do it (unless they
go to some s**t school like University of Phoenix or ITT - Idiot Technical
Institute).
If the EEPROM you're talking about is the on-board EEPROM on a
microcontroller, then it gets a lot messier! Unfortunately, I suspect
that this is likely the case for cellphones. There are a lot of RF
issues that one has to worry about when dealing with a cellphone,
and I could explain it, but people who are not engineers would not
understand.
Personally, I think it is easier to just subpoena the cell provider. I am
almost positive that they keep records of every text message going
through their system. I mean, storage is so damn cheap these
days.
oops I am going to start off this post pleading ignorance. I am probably the only one in the world that doesn't text message and haven't to date.
I recieved an inquiry as to whether or not text messages can be retrieved from a cell phone. I a) do not know if they get stored locally or b) if they get stored at a server level somehow.
How does that technology work?
I'm hoping to attend a cell phone forensics class in the near future but I'm not sure who has the best software for this and therefore who would have the better training. (I know, this thread has now officially crossed forums)
Any insight you may be able to provide would be much appreciated.
Thanks,
John
Hi John,
You can retrieve text messages from phones, but in most cases if they have been deleted, they are gone beyond recovery (I did say most). I have used alot of software solutions to recovering data from the phones (Paraben, Data Pilot, BitPim, SimCon, etc…). I can't say that one is better than the other because all phones are not created equal. A really good resource for you to look into is http//
It is a great resource for you to look at if you want to know how to analyze a particular phone. They have alot of phones in their database, but it is still rather small.
You can also contact the cellular provider and ask them if they store the text messages on their servers and for how long. I have had limited success in this as each provider is different and it requires a search warrant to be served on the provider in most states. Some provider even try to charge you to get text or picture messages, but there are ways around that too )
OK, I am going further than the question… I hope that helped.
I'm new to this "Forensic Word" but not to technology and I can tell you that it really depends on the make and model of your phone, and even on the carrier.
For example, I can tell you that my current phone (Motorola mpx220, which runs Windows Mobile as the OS) will delete call logs (incoming, outgiong, missed), messages and emails (incoming/outgoing/sent/draft) whenever the SIM is changed.. So all that info will be lost if you remove the SIM.
On most phones I've seen they give you the option to store msgs/contacts to the SIM but by default it is set to save to the phone. (Lately I've seen a lot of Moto Razr's, most of them from SunCom, that save numbers to the SIM by default)
On my phone I can choose wheter to store the data in the SIM or the phone memory.. Right now my phone is set to store everything in the internal memory.. So I'm guessing that if you analyze my SIM the only info there will be the subscriber info (to authenticate with the carrier).
Hope this helps somehow, again, I'm new to this so sorry if it doesn't help you