Practical Mobile Forensics - Fourth Edition

Extracting SMS/MMS

During the course of an investigation, you may be asked to retrieve the text messages that were sent by and delivered to a particular mobile device. Hence, it is important to understand where the details are stored and how to access the data. The mmssms.db file, which is present under /data/data/com.android.providers.telephony/databases, contains the necessary details. As with call logs, you must ensure that applications capable of messaging are examined for relevant message logs by using the following command:

adb.exe pull /data/data/com.android.providers.telephony C:\temp

This will give the following output:

Extracting ...