Practical Mobile Forensics - Third Edition

Extracting SMS/MMS

During the course of an investigation, a forensic examiner may be asked to retrieve the text messages that are sent by and delivered to a particular mobile device. Hence, it is important to understand where the details are stored and how to access the data. The mmssms.db file which is present under the /data/data/com.android.providers.telephony/databases location contains the necessary details. As with call logs, the examiner must ensure that applications capable of messaging are examined for relevant message logs, as follows:

The phone number can be seen under the address column and the corresponding text message can be ...