5

I'm trying to carve NAND flash raw dumps for SMS:s (for school, digital forensics), following the information on dreamfabric.com, but I'm having some trouble. First of all, the specification isn't complete as I'm seeing SMS:s that strays from this, and I feel there is a lot of noise in the data that conforms to the dreamfabric info (no clear header or trailer, fields can have widely varying values etc).

My current method is simply starting at each logical sector (512 bytes) and checking for 0, 1, 3, 5 or 7, and then do some simple sanity checks, but this results in a heap of false positives.

Any suggestions? Links to further info?

Thanks.

Improve this question

1 Answer 1

Reset to default
1

I don't know. You might need to do some experimentation of your own: e.g., send some test SMSs and see what that leads to in the dumps, and then try to corelate them.

Note that Android stores send/received SMSs in a database. You could try to locate that content provider on the phone's internal flash storage and analyze its contents. I imagine iOS might well be similar.

Improve this answer
1
  • I do have several SMS:s sent under particular circumstances, what I'm trying to do is to take other circumstances into account and have no way to simulate them (that I know of). When there's a database present the carving would be for the database and then extract them with the proper tools, so that's a different scenario.
    – spektre
    Commented Feb 29, 2012 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .