Posted: Wed May 18, 2016 9:16 am Post subject: Data information missing from Data Dump
Recently I was reviewing a case that (as usual) hinged heavily on ESI. We were given the data dump of a Samsung Galaxy phone. We also received the phone records of the suspect. The problem is that upon review we noticed that deleted text messages were missing from the data dump. For example we would have deleted text messages from 1/08/15, 1/09/15 and 1/10/15. On the 8th we have most of the text messages. A few are missing or incomplete. On the 9th we have all the messages. On the 10th we are missing all of the text messages. I am at a loss for why this might be. We have dumped all the data on the phone, yet information such as the aforementioned texts are missing. We know text messages were sent or received based off of the suspects phone records. I am afraid the text messages may have been overwritten.
Is there a way we can retrieve those messages or have they been overwritten? What are the chances the text messages were overwritten? What does everyone think?
Joined: Aug 08, 2006 Posts: 61 Location: Costa Mesa, California
Posted: Wed May 18, 2016 9:26 am Post subject:
First, what kind of extraction was performed (logical, file system, physical)? Secondly, what is the indicated source file, if any, of the text messages which are shown in the extraction? _________________ Mark Eskridge
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum