Recovering deleted messages
One of the most common tasks in a mobile device investigation is to attempt the recovery of data that was deleted by the user, such as chats and messages, as these may contain invaluable evidence.
In this chapter, we learned that SMS messages and chats from third-party applications are all stored in SQLite databases; this means that the ability to recover deleted chats effectively depends on the possibility of recovering any records from the SQLite database.
In Chapter 4, Working with Common iOS Artifacts, we discussed several options for the recovery of deleted records, such as the following:
- Parsing through the database using a hex viewer
- String carving
- Analyzing the Write Ahead Log (WAL) files
- Using forensic tools such as FQLite to recover data from free blocks and unallocated space
All of these solutions can be effective in recovering deleted messages, but only if the database was not vacuumed after the records were purged...