Information Technology Reference
In-Depth Information
Windows Phone Device Manager—The Manage Applications screen
Using this acquisition technique, you can acquire two types of data: system data and ap-
plication data. System data is mainly the data that is required to run the phone, and applic-
ation data is the data created and used by different applications installed on the device.
While system data may not contain data relevant to your investigation, application data is
very much valuable. Regardless, all data should be acquired from any smartphone as the
examination must be complete and capture all data contained on the device when possible.
The following sections discuss the steps to be followed to extract application data from a
Windows Phone device. The application data will contain the bulk of the user-created data
and will provide the most value to your investigation.
Extracting SMS
All the incoming and outgoing short messages (SMSes) in Windows Phone 7 are stored in
the file named
store.vol
, which is present under the directory
\Application
Data\Microsoft\Outlook\Stores\DeviceStore
, as shown in the next
screenshot. However, it is not possible to copy this file directly because this file is always
in use. When the file is renamed (say
store.vol.txt
or
store.bkp
), it automatic-
ally creates a copy of the file. Once the copy is made, this file can now be examined using
a normal text editor. Note that this file can also exist in the
\APPDATA\Local\Unistore
directory. Have a look at the following screenshot:
