Information Technology Reference
In-Depth Information
Other useful data extracted from the backup
The BlackBerry backup file contains a 2-byte hexadecimal value that, when converted to
decimal, reveals the number of database files contained within that backup file. The two
bytes of interest are the third and fourth bytes following the file header of the IPD backup
file. As shown in the following screenshot, the IPD file is being examined in a Hex viewer
to determine the number of database files contained within the IPD file. The third and
fourth bytes (
00 6D
) are going to be converted for database verification purposes. In the
following screenshot, Hex
6D
is converted to decimal, which is
109
. Therefore, there are
109 databases contained within this IPD file. It is important for the forensic tool to display
109 databases/tables for the examiner to analyze.
