Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on, but I'm having some trouble. First of all, the specification isn't complete as I'm seeing SMS:s that strays from this, and I feel there is a lot of noise in the data that conforms to the dreamfabric info (no clear header or trailer, fields can have widely varying values etc).

My current method is simply starting at each logical sector (512 bytes) and checking for 0, 1, 3, 5 or 7, and then do some simple sanity checks, but this results in a heap of false positives.

Any suggestions? Links to further info?


share|improve this question

I don't know. You might need to do some experimentation of your own: e.g., send some test SMSs and see what that leads to in the dumps, and then try to corelate them.

Note that Android stores send/received SMSs in a database. You could try to locate that content provider on the phone's internal flash storage and analyze its contents. I imagine iOS might well be similar.

share|improve this answer
I do have several SMS:s sent under particular circumstances, what I'm trying to do is to take other circumstances into account and have no way to simulate them (that I know of). When there's a database present the carving would be for the database and then extract them with the proper tools, so that's a different scenario. – spektre Feb 29 '12 at 10:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.