Thought your deleted text messages were gone forever? Think again!
1 min. read
Published on
Share this article
Improve this guide
Read our disclosure page to find out how can you help MSPoweruser sustain the editorial team Read more
Apparently criminals don’t all use iPhones, which has led to the development of forensic tools for the Windows Mobile operating system.
A blog post at SANS.org describes how one can recover deleted text messages, which of course is not only useful to CSI but occasionally to regular users like us who accidentally deleted a message before reading it.
The process is far from straightforward, but in essence requires reading the cemail.vol file, which like many other databases do not immediately overwrite data but simple removes pointers to it.
Some information can be read simply by using a HEX editor, but for a better view mounting the file in the Windows Mobile emulator may be more useful.
Can anyone think of a few scenarios where this capability may be handy? Let us know in the comments.
Read the full details at SANS.org here.
User forum
0 messages