Information Technology Reference
In-Depth Information
Once the files are extracted to the local machine, use the Oxygen Forensics
SQLite Viewer tool to open the
mmssms.db
file.
2. Click on the table named
sms
and observe the current message under the
Tables
data tab in the tool.
3. One way to view the deleted data is by clicking on the
Blocks containing deleted
data
tab, as shown in the following screenshot:
Recovering deleted SMS messages
Similarly, other data residing on Android devices which store data in SQLite files can be
recovered by parsing for deleted content. When the preceding method doesn't provide ac-
cess to the deleted data, the examiner should look at the file in raw hex file for data
marked as deleted, which can be manually carved and reported.
Recovering files using file-carving techniques
File carving is an extremely useful method in forensics because it allows for data that has
been deleted or hidden to be recovered for analysis. In simple terms, file carving is the
process of reassembling computer files from fragments in the absence of file system
