Investigating Android SMS
09/02/2024 Friday
The Android SMS service is a fundamental feature of the Android operating system that enables users to send and receive text messages on their mobile devices. It provides a convenient and reliable means of communication, allowing users to exchange text-based information with contacts in their address book or any phone number. Users can compose, send, receive, and manage SMS messages through the native messaging app or third-party messaging applications available on the Google Play Store.
Digital Forensics Value of Android SMS
Digital forensics derives significant value from Android SMS data due to its potential to provide crucial evidence in investigations. SMS messages can serve as timestamps for communication events, offering insights into the timeline of interactions between individuals. The content of SMS messages may contain valuable information related to criminal activities, including conversations about illegal transactions, plans for unlawful acts, or coordination of criminal behavior. Furthermore, analysis of SMS metadata, such as sender and recipient phone numbers, can aid in identifying key individuals involved in a case. Additionally, SMS data can be correlated with other digital evidence, such as call logs, location data, and internet browsing history, to build a comprehensive understanding of a suspect's activities and associations.
Location of Android SMS Artifacts
Android SMS artifacts can be found at the following locations:
/data/com.android.providers.telephony/databases/mmssms.db
/data/com.android.providers.contacts/databases/calllog.db
Analyzing Android SMS Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Android SMS artifact from Android devices’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Android SMS artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Android SMS artifact in ArtiFast.
Android SMS
- Message Date: The message received or sent date/time.
- Message ID: The database row ID of the message.
- Thread ID: The thread ID of the message.
- Number: The message partner’s number.
- Name: The message partner’s name.
- Message Type: The direction of the message (incoming or outgoing).
- Message Body: The message body.
- Sent Date: The sent date.
- Last Modified Date: The last modified date.
- Status: The current status of the message.
- Country: The country where this message has been initiated.
- Geo Coded Location: The geographic location where this message has been initiated.
- Is Read: Indicates whether this message has been read or not.
- Normalized Number: The normalized version of the partner’s number.
- Formatted Number: The formatted version of the partner’s number.
- Lookup URI: The lookup URI.
- Is Seen: Indicates whether this message has been seen or not.
- Is Locked: Indicates whether this message has been locked or not.
- Error Code: The error code if an error occurred during the sending process.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
