We text about everything today from personal communications with friends to quick blasts to business associates. And the options of ways in which we can send text messages—SMS and MMS, iMessages, Android native messages, chat, and messaging apps like Slack—enables a whole new form of communication.

In digital forensics cases, text messages play a critical (and growing) role in examinations.

In light of this, we have enhanced the way messages are handled in Cellebrite Physical Analyzer to break down the message silos and provide a unified view for all messages while focusing on context, rather than the mechanics.

While we believe that the type of messages being sent and received is important, investigators want to see conversations between people, whether one of the messages is technically an SMS and the reply is an iMessage, MMS, or chat – it is not as significant.

This new approach enables users to view native messages, just as they would appear on the device, under a single, unified conversation view (based on forensic Chat IDs and the participants).​

Version 7.38 of Cellebrite Physical Analyzer does not represent SMS and MMS as separate objects. Instead, the latest upgrade displays all messages within Chats in the form of Instant Messages. These messages will appear as part of a conversation, enabling a full review of the communication between parties in a convenient display that provides a native mobile experience.

We have invested time and effort to further extend our ability to identify message threads and accurately record them by grouping them into the above mentioned Chats. In some cases, mainly in instances where messages have been deleted, we will not be able to forensically place the messages in a Chat.

In such cases, we have maintained the forensic accuracy of the messages by creating Instant Messages that are not associated with any specific Chat. You will be able to review these items under the “Instant Messages” menu item in the “Analyzed Data” tree structure.

In addition, we have expanded the Instant Message property set to ensure it has everything needed to cover all types of messages. This also includes a field indicating the type of message—SMS, MMS, iMessage, or Application Message.

The messages can be found in the tree, under Messages -> Chats -> Native Messages.

Each one of the Instant Messages now has its original type (SMS, MMS, iMessage, or App Message) and additional metadata like SMSC, Folder, etc.

We constantly strive to improve our products based on your input. We have listened to your feedback over the years and adjusted our products to provide you with a more intuitive approach to reviewing digital forensic data overall while also providing the means to drill down into specific mobile messaging information, where needed. We hope you find this approach useful and that it will serve you in your digital investigations.

At Cellebrite, “Digital Intelligence for a safer world” is not just a slogan, it’s a way of life.

Learn more about how our digital intelligence solutions can expedite your investigations, here.

Share this post