Information Technology Reference
In-Depth Information
Cellebrite Physical Analyzer—Address Book examination
BlackBerry data, stored in
databases/tables
, is often proprietary, which causes dif-
ficulties when attempting to interpret data using the tool and manually by the examiner.
When compared to other smartphone devices, there doesn't appear to be a clear standard
for data on BlackBerry devices. For example, status flags associated with the e-mail app
have been found to be inconsistent among different devices. Commonly, a status flag is
consistent within a table for a specific model. This has been found to be untrue for Black-
Berry. For examiners, this makes validation of your tool difficult. BlackBerry timestamps
are commonly in a simple date format, which is compatible with Java and is supported to
parse by most forensic tools.
