The Association of Digital Forensics, Security and Law (ADFSL)
Both SMS and MMS data analysis is an important factor in mobile forensic analysis. Author did not find any mobile forensic tool that is capable of extracting short messages (SMS) and multimedia messages (MMS) from Palm Treo 750. SMS file of Palm Treo 750 is called PalmMgeV001 and it is a proprietary file system. A research work done to find a method to recover SMS data from PalmMsgV001 file. This paper is going to describe the research work and its findings. This paper also discusses a methodology that will help recover SMS data from PalmMsgV001. The PalmMsgV001 file is analysed using hex analysis method. Solutions were found to recover each message from every folder like Inbox, Outbox, Sentbox, Draft and Template. The research work partially contributes to improving mobile forensic analysis since the finding will be helpful to forensic tool developers. At this stage, this study will concern only the SMS part and not the MMS part.
ACPO (2003). Good Practice Guide for Computer based Electronic Evidence. Journal. Retrieved from http://www.acpo.police.uk/asp/policies/Data/gpg_cpmputer_based_evidence_v 3.pdf
Bodic, G. L. (2005). Mobile Messaging Technologies and Services: SMS, EMS and MMS (2nd ed.): John Wiley and Sons.
ETSI. (1999). ETSI TS 100 901 V7.4.0 (1999-12): Digital cellular telecommunications system (Phase 2+);Technical realization of the Short Message Service (SMS);(GSM 03.40 version 7.4.0 Release 1998). Retrieved 18 July, 2008, from http://amber.feld.cvut.cz/user/pokorny/bpdp/GSM_0340.PDF
McCarthy, P. (2005). Forensic Analysis of Mobile Phones. Retrieved 18 Aug, 2008, from http://esm.cis.unisa.edu.au/new_esml/resources/publications/forensic%20analy sis%20of%20mobile%20p hones.pdf
Press, T. A. (2008). Dozens of college students busted in drug sting. Retrieved 28/9/2008, from http://www.msnbc.msn.com/id/21134540/vp/24487634#24487634
Trosby, F. (2004). SMS, the strange duckling of GSM. Retrieved 22 July, 2008, from http://www.telenor.com/telektronikk/volumes/pdf/3.2004/Page_187-194.pdf
UltraEdit Text Editor Features. (2008). Retrieved 5 Aug., 2008, from http://www.ultraedit.com/products/ultraedit/ultraedit_features.html
Visual File And Directory Comparison Tool. (2008). Retrieved 25 Aug, 2008, from http://www.prestosoft.com/edp_examdiffpro.asp
"Data recovery from PalmmsgV001,"
Journal of Digital Forensics, Security and Law: Vol. 3
, Article 3.
Available at: http://commons.erau.edu/jdfsl/vol3/iss4/3