If you're missing text messages, this is why.
So we have two different screenshots here.
So the first thing I would do is look
at comm.apple.MobileSMS.plist and see days to keep.
How long are they keeping their messages?
And then I would look at the settings on the iPhone.
Now, this is super important.
During your acquisition, if you can, go into the user's phone,
click on iCloud, and photograph the settings
on what they're sinking the cloud or not.
This will help you possibly get search warrants
or consent to get cloud data, but this may also
save you a lot of time and heartache
if you're hunting for messages that may not exist.
So when we look at messages specifically,
if this button is ever turned to green,
ever, you will never see deleted text messages on that iPhone
again.
So this is very important.
Notice I did not say iMessage.
You will not see deleted messages.
So if I text Android users and I delete that message,
it wil never exist on the device again.
Where do you think it exists?
In cloud-- now, here's the tricky part.
If you photograph the screen--
and over here it looks like it's turned off--
you don't know if it was ever turned on,
and there's no way to tell you.
I don't know how to tell you that,
oh, it used to be turned to green, and now it's turned off.
But if the user switches it off, you
may be able to recover current messages
before the sync occurs.
But you're not going to recover others.
If the person never turned it on,
you can recover deleted until vacuuming occurs-- which,
Apple's pretty quick at vacuuming the sms.db,
so you may find that you never recover it.
So once it's set, there's no going back.