This week’s Tip Tuesday is about what Cellebrite has added regarding the new features in iOS 16.

One of these features is being able to unsend and edit messages within a set period of time after the message is sent.

You can see what this looks like in Messages in Physical Analyzer. When you find a conversation of interest and it’s not making sense, take a closer look at the message.

Look at the date timestamps, and you will see specific timestamps on two conversations going back and forth.

We can see “before edit, after edit 1”, and we see this trashcan. Then you see “before edit, after edit 2”, and we see the trashcan. The edited messages with a trashcan next to them are not the original message. The source file for this is the SMS database.

When you’re looking at these messages, the edit may not be the very first message, but the messages that have been changed.

I recommend reading the blog by Cellebrite Senior Digital Intelligence Expert Ian Whiffin. He released this in June 2022, and it breaks down everything you need to look at in the database to verify the edited messages, the dates that they were edited or unsent, and how to verify.

Watch the full episode to learn more.

Share this post