Page 1
SMS & I MESSAGE EVIDENCE · A GUIDE FOR UK LAWYERS SMS and i Message Evidence Message Databases, Cloud Sync, Deleted Threads, Timestamps and Attribution on the Phone's Native Channels COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MESSAGE-DATABASE FORENSICS CLOUD & BACKUP ARCHAEOLOGY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: two services in one inbox 03 The stores: message databases and their deleted layers 04 iMessage's ecosystem: sync, devices and backup lineages 05 SMS's ecosystem: carriers, o per at or records and RCS 06 Deletion and recovery: windows, propagation, realities 07 Timestamps, attribution and authentication 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ONEINBOX, TWOARCHITECTURES: ANDTHEARCHITECTURE DECIDESWHERETHEEVIDENCELIVESANDHOWITDIES
§ 02 · FIRST PRINCIPLES The problem in plain English: two services in one inbox
§ 03 · THESTORES The stores: message databases and their deleted layers
Page 2
§ 04 · THEAPPLEECOSYSTEM iMessage's ecosystem: sync, devices and backup lineages
§ 05 · THECARRIERSIDE SMS's ecosystem: carriers, o per at or records and RCS
§ 06 · GONE, ANDBACK Deletion and recovery: windows, propagation, realities
§ 07 · STANDINGUP Timestamps, attribution and authentication 63) applied natively: the checkmate for contested threads.
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE DEVICE DEVICES (SYNC/ PRIMARY PEER ICLOUD (FFS) (MAC, IPAD) BACKUPS) COMPUTER COUNTERPART DELETED / BACKUPS + O PER AT OR RECOVERABLE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEMACTHATREMEMBEREDTHERESIGNATION EXAMPLE2 · THEWINDOWTHATCAUGHTTHEWEEKENDEDIT EXAMPLE3 · THEOPERATORRECORDSTHATOUTLIVEDBOTHPHONES
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · N AT IVE - CHANNELLIMBFORTHEPRESER VAT I ON LETTER
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The native-channel checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Can deleted texts be recovered? Can we get message content from the phone companies? Someone unsent a message. Is it gone? How do we prove who actually sent a text from a shared or accessible phone? The thread mixes green and blue bubbles. Does the analysis change mid-conversation? What single step best protects a native-channel case this week?
§ 14 · REFERENCE Glossary RCS. Sources and authoritative references 35 reporting): cflab.uk/digital-forensics-services · guides library: cflab.uk/guides DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, SMS And IMessage Evidence, Computer Forensics Lab, https://e-discovery.uk/library/sms-and-imessage-evidence/pdf.