Mobile Forensics · Where the Evidence Lives · Lesson 2 of 5

Messages & Call Logs

Learn where texts, chats and call history are kept, and what encryption changes.

The built-in inbox and the call list

Messages and call history are some of the most requested evidence in a case, and also some of the most private. An examiner only looks at them when there's legal authority to do so, such as a warrant, the owner's consent, or an organization examining its own device. Even then, they stay within the scope that authority covers.

On both platforms, the phone's built-in texts and calls are kept in SQLite databases like the one you explored in the last module.

• iPhone. Texts and iMessages are stored by the Messages app in a database that examiners commonly know as sms.db. Call history lives in a separate database. Apple doesn't publish these details, and names and layouts can change between iOS versions, so examiners confirm them for each version they work on.
• Android. The system keeps texts in the Telephony provider, a shared store for SMS and MMS messages, and recent calls in the Call Log provider. A provider is Android's way of letting approved apps read and write a shared set of data. Each one is backed by a database, but where that file sits varies by Android version and manufacturer.

Android's developer documentation lists what a call log row records, including the number, the type of call (incoming, outgoing or missed), the date in milliseconds since 1970, and the duration in seconds. For texts, there are separate dates for when a message was sent and when it was received.

Android is also strict about who may change the text message store. Only the app the user has picked as the default SMS app can write to it. That's useful to know when a record looks odd, because an ordinary app can't quietly insert a fake text there.

One caution: newer chat features such as RCS (the upgraded texting standard) may be stored by the messaging app itself rather than in the system provider, depending on the app and version.

Chat apps, encryption and attachments

Plenty of conversations never touch the built-in inbox. Chat apps like WhatsApp, Signal or Telegram each keep their own databases inside their own app sandbox, the private storage area that other apps can't open. So an examiner can't just look in one place. Each app has its own layout, and it can change with every update. Some apps, Signal among them, also encrypt their local database, which adds another layer to deal with.

You learned in Mobile Networking that end-to-end encryption (E2EE) means only the people in a conversation hold the keys. The app's own servers carry scrambled data they can't read. That's real protection, and it's why a provider may have no message contents to hand over, even with a court order.

But E2EE protects messages in transit, while they travel. To show you a message, your phone has to decrypt it. Once it's decrypted and saved on the device, it's protected by the phone's own security instead: the passcode, Data Protection classes, and whether the phone is in BFU or AFU. So a lawfully examined phone can still contain readable copies of end-to-end encrypted chats.

Backups and sync matter too. On iPhone, Apple says Messages in iCloud is end-to-end encrypted, but if iCloud Backup is on without Advanced Data Protection, the backup includes a copy of the key.

Attachments such as photos, videos and voice notes usually aren't stored inside the message database. The database holds a row that points to a separate file elsewhere in the app's storage. Examiners check both. A message row can survive after its attachment file is deleted, and an attachment file can survive after its message row is gone.

Finally, look for what's missing. Disappearing message settings and auto-delete options remove content on a timer, so a short history isn't always a sign that someone deleted things by hand.