Android Forensics Deleted Data Traces

Oxygen Forensic Suite 2012 is able to extract and show deleted data. The type and amount of data depends on the mobile device platform. Here is the list of data that is available for android forensics investigation.

  • Deleted SMS messages information is stored in mmssms.db file which can be found in the File Browser section and opened with SQLite Database viewer. This database is accessible for rooted devices only.
  • Deleted Android device logs (traces of SMS, MMS and applications messages with names and phone numbers) are stored in logs.db file which can be opened with SQLite Database viewer in the File Browser section.
  • Physical acquisition is available is the most effective way of deleted data recovery for Android devices and can be easily performed by Android Rooting Add-on  supporting devices with Android OS 1.6-3.0.1 covering more than 96% devices on the market.
  • Traces of deleted data can be found in all SQLite databases stored in the mobile device and therefore recovered with SQLite Database viewer.

Find more details about forensic deleted data recovery in Deleted Data Traces document.

This entry was posted in Articles, Features, News. Bookmark the permalink.

One Response to Android Forensics Deleted Data Traces

  1. Pingback: Android Forensics Deleted Data Traces | Android Forensic Software » ForensicGuru.org – Articles