Text Messages… Myths & Magic

I have recently been fielding calls and inquiries from clients who want to find, preserve and recover deleted text messages.

I wouldn’t go as far to say that text messages are the new email, but I can say the amount of personal and business communication being conducted via text is significant. We have seen cases involving trade secrets theft, domestic violence, employment claims, workers comp, accidents.  There are many different types of cases that hinge on information that was or wasn’t sent via text message.

Cell Phone Carriers:

Many people operate under the assumption that the cell phone carriers (AT&T, Verizon, Sprint, T-Mobile) document or preserve all text communication by their customers. This is simply not true. What the carriers typically keep track of are the phone numbers the messages are sent to and the frequency and time and date of the messages. What this means is that even with a subpoena that requires getting the cooperation of the carrier, the actual text messages are not available.

Other Options and Strategies:

Text messages can be pulled from the phone using software for practical and forensic purposes, assuming you have legal access to the phone. The idea that even with the phone in his or her possession your computer forensics analyst can extract deleted text messages is also not accurate.

A cell phone, android or iPhone, uses a solid state-flash storage drive to store information and run the operating system. The phones dynamically write to the storage drive as the user accumulates messages, pictures, emails, etc. As the user deletes information the phone will dynamically write over available space. What this means is that information that has been deleted that you need for your case might not be recoverable even using forensic software.

If your subject is an iPhone user, the text messages or voicemails you need may have been overwritten and are not recoverable. There is another option. If you can get access to the computer that your subject backed up that iPhone to, there are likely complete backups of that iPhone on the computer . When you backup an iPhone a complete copy of the information on that phone is placed on the computer.

Written by Tim Santoni , Santoni Pres/CEO