Summary

Forensic support for BlackBerry devices is limited when compared to other smartphone devices. Open source tools supporting BlackBerry physical acquisition are not currently available, and bypassing a locked device is complicated and often renders the data encrypted and unusable. Unlike iOS and Android devices, our most successful data extractions of BlackBerry devices usually come from the file system image or backup file. Information such as e-mail, SMS, contacts, and more can be extracted from BlackBerry backup files. Sometimes, the most useful information is the data extracted from a backup file, which provides access to the most data for analysis.