Android Messaging SMS RCS And Messaging Apps
ANDROIDMESSAGING · A GUIDE FOR UK LAWYERS Android Messaging: SMS, RCS and Messaging Apps Where Conversations Live on Android, Why the Messaging App Matters, and What Deletion Leaves Behind COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: no single Messages app 03 SMS, RCS and the messaging app in use 04 Where Android messaging lives 05 What survives deletion 06 Encryption, edits, attribution and honest limits 07 Deployment: recovering and proving conversations 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: Android has no single Messages app, so SMS and RCS are handled by which ever messaging app is in use, each storing them differently, alongside the third-party apps, which means the messaging app must be identified because it decides where the messages are, while deleted messages very often survive in databases, backups, the Google account and counterpart devices.
§ 02 · FIRST PRINCIPLES The problem in plain English: no single Messages app
§ 03 · SMS, RCSANDTHEAPP SMS, RCS and the messaging app in use COUNTERPARTS
§ 04 · WHEREITLIVES Where Android messaging lives
§ 05 · WHATSURVIVESDELETION What survives deletion
§ 06 · ENCRYPTION, EDITSANDATTRIBUTION Encryption, edits, attribution and honest limits
§ 07 · DEPLOYMENT Deployment: recovering and proving conversations
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE THE GOOGLE MANUFACTURER / COUNTERPART CARRIER DELETED / PHONE ACCOUNT LOCAL BACKUP DEVICE RECORDS RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEMESSAGESTHATWEREINADIFFERENTAPP EXAMPLE2 · THEDELETEDRCSTHREADANDTHEGOOGLEBACKUP EXAMPLE3 · THETHREEAPPSANDTHEONETHATWASTRULYGONE
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORANANDROIDMESS AG INGANA LY SIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Android messaging checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Where are the text messages on an Android phone? What is RCS, and does it change anything? Someone deleted their messages. Can they be recovered? The messages were end-to-end encrypted. Doesn't that stop recovery? Do we need to look at the third-party apps too? Does a message prove who sent it?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Android Messaging SMS RCS And Messaging Apps, Computer Forensics Lab, https://e-discovery.uk/library/android-messaging-sms-rcs-and-messaging-apps/pdf.