Data - Messages

Data - Messages

Messages

"Phone messages" groups the SMS, MMS, iMessages, application messages and any standard phone messages together. Forensic Express can find any variation of these types of message, and present the gathered data in the report generated.

Emails and Email messages are gathered separately in their own section and will not be shown in the Messages section of the report.



Phone messages – standard phone messages, which covers SMS, MMS, and iMessages on the iPhones.

SIM messages – messages retrieved from the SIM card, if available.

Application messages - if selected, all messages from all applications will be merged together with the standard phone messages. If not selected, application messages will be shown only in their respective application sections of the report.

Deleted messages – this option turns on recovery of deleted messages, wherever it is possible. Any recovered deleted messages are placed together with regular messages and are visibly marked as 'deleted'.

Conversations - displays phone messages in the conversation view only, which is a shorter format; but please note that it is possible that not all available information stored in the messages may be displayed.

Detailed messages - shows messages with all details, without the conversations.

Both – shows the conversations followed by the detailed messages.

Display order of messages



Messages in the report can be ordered by:

  • Time, which sorts by the time and date they were sent or received
  • Contact name in the message
  • Type of message, such as sent or received
  • The conversation that the message is included in

To see examples of what reports will look like, based on various settings, go to the Report in details section.

Example of messages report:

Keep in mind that if you will filter, for example, the messages by content: "Hi" you will get even words that have the word Hi in them... for example a word: this


    • Related Articles

    • How to extract messages and other files if they are not already in an export

      You might have found out that some applications do not provide their information that you need (e.g. messages, call logs) by themselves it is due to information being encrypted by developer/manufacturer.   There are a few ways how to extract your ...

    • Data - Deleted data

      We do offer more ways to recover deleted data. The first one is recovering the data from SQLite databases, the second one is recovering the files and folders from physical images. SQL databases allow you to recover the data which were marked as ...

    • Data - data extraction log

      Following tab displays information about ongoing extraction: if you select the Data Extraction Log option in the Specific selection, you will get a brief resume of the extraction tab in your report as well:

    • Data - SIM card

      Extracts data from the SIM card such as IMSI, Country, ICCID, and Operator as shown below:

    • What deleted data can I retrieve?

      Some deleted data will appear in the report. Deleted data type depends on the phone used.  Android: We can retrieve deleted messages if the phone is rooted. If the phone is not rooted we can still get some deleted application data (messages, browsing ...