SMS and MMS are probably the most commonly supported
and really well parsed items from an Android device.
However, there are some weird things that occur,
and you're going to see this in your lab.
We have lots of locations too.
So let's start from the top.
Under com.android.providers.telephony,
we have databases.
We have the mmssms.db.
There are so many tables of interest.
We'll look at every single one.
Quickly just click on these tables
and see if it has any relevance to you.
If it does have relevance, see if your tool parsed it.
If not, you're going to have to write a query.
You can definitely do this.
Under data/user_de-- so I want you to reverse your mind back
to Section 1, at the end of the day,
when I talked about the differences and the basics
of Android.
User_de is User Device Encrypted.
So the device must be completely decrypted
before you can see anything.
Under user_de, 0 is the primary user.
We could see that we have app_parts.
This could contain attachments that
were opened from text messages.
And then the final--
Samsung doing its thing again--
Samsung will store messages in messages_content.db as well
as mmssms.db.
You may find messages, recipients, contacts,
conversations, all of the things.
You must examine all of these.
It's very important.
If communication is a key part of your investigation,
make sure your tool is finding all of these.