Key artifacts for examination
In this section, we are going to introduce you to the location of some of the most common Windows Phone forensic artifacts, including contacts, SMS, and call and internet history.
Extracting contacts and SMS
All the contacts and incoming and outgoing short messages (SMS) in Windows Phone 7–10 are stored in the file named store.vol, which is present under the \Application Data\Microsoft\Outlook\Stores\DeviceStore (Windows 7) and Users\WPCOMMSERVICES\APPDATA\Local\Unistore (Windows 8-10) directories. An example of a Windows 10 store.vol file is shown in the following screenshot:
The store.vol file in a Windows Phone
Extracting call history
Call history data can currently be extracted from the Phone file. It's important to note that the file doesn't have an extension and is located at \Users\WPCOMMSERVICES\APPDATA\ Local\UserData\. Here is an example of a Windows 10 Phone file:
The Phone file in a Windows Phone
Extracting internet history
Internet history can be extracted...
