Restoration of sms in mobile phone

1. The most important characteristic of a forensic tool is its ability to maintain the integrity of the original data source being acquired and also that of the extracted data. The former is done by blocking or otherwise eliminating write requests to the device containing the data. The latter is done by calculating a cryptographic hash of the contents of the evidence files created and recurrently verifying that this value remains unchanged throughout the lifetime of those files. Preserving integrity not only maintains credibility from a legal perspective. This is case when Mobile phones and or SIM cards are presented in Courts of Law as evidence for forensic examination.  


2. The Court on the request and or agreement of the parties to the Case sends the mobile phone device and or SIM card to a authorized Forensic Lab for examination or data mining.  Mind it here the Court does not sends it to an Authorised Service Centre! The forensic lab presents a report with texts / images / audio and all such integer numbers stored in either the mobile device and or in the SIM card itself recovering / converting integers into legiable datas as the case may be in a sealed envelop to the Court.


3. What actually the Forensic Lab tests / reports in such media devices and or SIM cards while gleaning it is that they try to find a forensic hash which is used to maintain the integrity of an acquisition by computing a cryptographically strong, non-reversible value over the acquired data. After acquisition, any changes made to the data can be detected, since a new hash value computed over the data will be inconsistent with the old value. {if you say to us that Service Center people have already recovered via their software datas which were lost due to media devise submirging in water then it is "change in crypto. hash!" And it will get reported by Forensic Lab that such and such time the mobile phone and SIM card had come to a halt including mobile tower unmistakable mapping to this particular point and any variable data that it shows now are direct import of it being “tampered”.

4. The remedy (i.e too late is my view after reading that it was already tampered by a Service Center) is to present the media "as is where is" condition without sending it an un-authorized reloader and state factually to the Court that "such and such evidence is there in the SIM card which I am relying upon, but on such and such date accidentally it got submerged in pool of water and I want the media sent to Forensic Lab by leave of this Court and let them discover the map and recover "original SMS texts which is my sole evidence in this case" and present such texts as their sealed report to this Court and Court may consider my submissions accordingly."

This way your submitted evidence thus recovered by Forensic Lab via a specific Court order will be factually acceptable to Court of Law instead of acting "over smartly and or hurriedly" spoiling your case in beginning itself.

Note:-

Un-authorized – When you say to us that such media was to be presented in a case before a Court of Law as evidence then even such Service Centre personals becomes un-authorised and it is still called as tampering / tampered media that is where majority of media cases (SIM card / mobile devices / Emails / CD's) you hear on/off on TV / Newspaper hopelessly fails.  Service Centre personals are not qualified to give Expert opinion in a forensic case nor they can do forensic examination of the media(s).

dear tajobs....thank you very much for your kind and valuable information here, appreciate your kind help........

A really well explained piece about the whole process. Kudos Tajobsindia!!

dear sir. just wanted to know, when the forensic lab recovers the data, only the relevant sms/data is recovered or the entire data in the phone is recovered, can we request that only data of xyz be recovered? is this possible?

thanks once again....