How reliable is recovered data?

How reliable is recovered data?

  1. Message timestamps are stored in databases as single numbers. More information about the most popular format of storing timestamps can be found here: https://en.wikipedia.org/wiki/Unix_time. Recovered data are often already partially rewritten, and if one of the rewritten items is the timestamp number, then after converting it to a readable time format you basically end up with a random date that falls into the constraints of a given timestamp system used.

  2. Recovered data is never 100% reliable. However the probability of date being shifted only a little is very low. This is due to the way data are stored internally - small changes in data usually result in big changes in timestamps and it is rather hard to edit just least significant bits of the binary number that represents the timestamp. You can usually tell if the recovered item is corrupted or not. Look for indicators such as an unreadable or scrambled message body or other anomalies.

Data from one message are usually stored sequentially in the database and if some deleted entry is about to be rewritten and still remain recoverable then only the trailing part of the entry can be rewritten. Timestamps are usually stored in the front part of an entry, and therefore if they become corrupted so does everything else that follows them.


    • Related Articles

    • Data - Deleted data

      We do offer more ways to recover deleted data. The first one is recovering the data from SQLite databases, the second one is recovering the files and folders from physical images. SQL databases allow you to recover the data which were marked as ...
    • Data - data extraction log

      Following tab displays information about ongoing extraction: if you select the Data Extraction Log option in the Specific selection, you will get a brief resume of the extraction tab in your report as well:
    • Data - SIM card

      Extracts data from the SIM card such as IMSI, Country, ICCID, and Operator as shown below:
    • Wrong information in recovered data

      Recovering any deleted data is a special and complex process and it is not possible to recover them always fully with 100% data accuracy. We deeply analyze data and bring the best possible results, however if you know about any other tool bringing ...
    • Data - Filesystems

      Full FileSystem - if this option is selected then all files from the phone will be copied, and will be included within the list in the report. Please note that this might analysis may take a long time and can consume a considerable disk space, ...