Social media applications like Snapchat, WhatsApp, and Telegram market themselves on privacy, promising that messages disappear after a set time. While true on the screen, these messages often persist in system cache databases, temp folders, and log buffers on the physical device.
Carving the SQLite Database
Most mobile applications store local message history in SQLite databases. When a message is deleted, the database does not erase the record immediately; it simply marks the index block as "free list" or "unallocated." Until that block is overwritten by new data, the original message remains intact.
Deleted Data Recovery: By parsing unallocated space within sqlite databases, examiners can reconstruct complete threads, read sent/received text, and extract embedded pictures.
What We Look For
- Sandbox Directories: Inspecting local cache, cookies, and media directories.
- Shared Preferences: Reading plist and xml config files containing login info and active sessions.
- Memory Carving: Scanning volatile cache memory for trace patterns of active message threads.
Our examiners specialize in reconstructing deleted conversations and providing forensic reports that establish intent, timeline, and admissibility in civil and criminal proceedings.