MOBILE FORENSICS

Forensic analysis of Android SMS and MMS messages

Despite the availability of modern messaging apps, SMS and MMS messages remain important in many cases. They can provide evidence of communication histories, timings and the mobile numbers involved, and often form a key part of a mobile IT forensic investigation.

SMS and MMS databases (e.g. mmssms.db)
Messages sent, received and drafted
Telephone numbers and contact details
Attachments and MMS content
Timestamp
Delivery and dispatch status
SQLite databases
Synchronisation and backup artefacts

TECHNICAL BACKGROUND

Technical Fundamentals

Android stores SMS and MMS data in system-level databases and other artefacts.

Information relevant to forensic investigations may include, amongst other things:

  • •SMS and MMS databases (e.g. mmssms.db)
  • •Messages sent, received and drafted
  • •Telephone numbers and contact details
  • •Attachments and MMS content
  • •Timestamp
  • •Delivery and dispatch status
  • •SQLite databases
  • •Synchronisation and backup artefacts

Storage locations and data structures may vary depending on the version of Android, the manufacturer and the messaging app.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following a suitable forensic data backup, messages, databases, attachments and metadata are analysed using recognised IT forensic tools and manual analysis. Timestamps are correlated with call logs, contacts and other technical artefacts. All stages of the investigation are documented in a reproducible manner and assessed solely on the basis of objective technical findings.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which SMS and MMS messages have been saved?
  • ✔When were messages sent or received?
  • ✔Which telephone numbers were involved?
  • ✔Is it technically possible to recover deleted messages?
  • ✔How significant are the existing artefacts?

LIMITATIONS & CONCLUSION

What you should know

Deleted messages, overwritten data or manufacturer-specific differences may affect the scope of the available data. Statements are made solely on the basis of the technical artefacts that are actually present.

Analysing SMS and MMS data can provide important insights into communication patterns. A reliable assessment requires a comprehensive analysis of all available data sources.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have SMS or MMS data from an Android device professionally examined? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Where are text messages stored?
Depending on the version of Android, in system-level SQLite databases such as mmssms.db.
Are MMS attachments scanned?
Yes. Where available, images, videos and other attachments may form part of the analysis.
Can deleted text messages be recovered?
That depends on the data set and the artefacts available.
Are timestamps relevant in a forensic context?
Yes. They are important for reconstructing communication processes.
Could an expert report be drawn up on this matter?
Yes. The results are documented in a transparent manner and assessed from a technical perspective.