A blog post at SANS.org describes how one can recover deleted text messages, which of course is not only useful to CSI but occasionally to regular users like us who accidentally deleted a message before reading it.
The process is far from straightforward, but in essence requires reading the cemail.vol file, which like many other databases do not immediately overwrite data but simple removes pointers to it.
Some information can be read simply by using a HEX editor, but for a better view mounting the file in the Windows Mobile emulator may be more useful.
Can anyone think of a few scenarios where this capability may be handy? Let us know in the comments.
Read the full details at SANS.org here.