Page 1

SMS & I MESSAGE EVIDENCE · A GUIDE FOR UK LAWYERS SMS and i Message Evidence Message Databases, Cloud Sync, Deleted Threads, Timestamps and Attribution on the Phone's Native Channels COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES MESSAGE-DATABASE FORENSICS CLOUD & BACKUP ARCHAEOLOGY CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: two services in one inbox 03 The stores: message databases and their deleted layers 04 iMessage's ecosystem: sync, devices and backup lineages 05 SMS's ecosystem: carriers, o per at or records and RCS 06 Deletion and recovery: windows, propagation, realities 07 Timestamps, attribution and authentication 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: ONEINBOX, TWOARCHITECTURES: ANDTHEARCHITECTURE DECIDESWHERETHEEVIDENCELIVESANDHOWITDIES

§ 02 · FIRST PRINCIPLES The problem in plain English: two services in one inbox

§ 03 · THESTORES The stores: message databases and their deleted layers