Mobile Device Forensic Laboratory • Houston, Texas
Cell Phone Forensics & Deleted Message Carving
Court-admissible iOS and Android mobile extractions, unallocated SQLite database recovery, and evidentiary reporting under Federal Rule of Evidence 902(14) and Texas Rule of Evidence 902(10).
How Are Deleted Text Messages Extracted for Court Admissibility in Texas?
Court-admissible text message extraction requires a forensically sound physical or advanced logical acquisition that preserves chain of custody and satisfies Federal Rule of Evidence 902(14) and Texas Rule of Evidence 902(10). At E-Investigations, lead examiner Gary Huestis utilizes bit-stream imaging and unallocated space SQLite database carving (sms.db, chat.db) to recover deleted SMS, iMessage, WhatsApp, and Signal communications with cryptographic SHA-256 hash verification.
Forensic Mobile Extraction & Deleted Data Carving
Consumer backup utilities and off-the-shelf commercial phone recovery software only extract visible, active user files. They fail to recover deleted data, do not compute cryptographic verification hashes, and routinely overwrite volatile evidence, rendering the results inadmissible under judicial cross-examination.
At E-Investigations, our digital forensics laboratory employs forensic-grade hardware and software pipelines, including Cellebrite UFED, Magnet AXIOM Cyber, and custom low-level extraction engines (such as our proprietary Baylexx framework) to access low-level flash memory structures:
1. SQLite B-Tree Slack Carving
When an iMessage or WhatsApp text is deleted, iOS/Android marks the SQLite B-Tree cell as unallocated. We parse unallocated page blocks, recovering message text, recipient handles, and epoch timestamps before page defragmentation occurs.
2. Write-Ahead Log (.wal) Reconstruction
Modern smartphones store live database transactions in SQLite write-ahead log files (sms.db-wal). We extract transaction frames prior to checkpoint commits, uncovering historical messages and modified draft states.
3. Monotonic ROWID Spoliation Analysis
SQLite autoincrement primary keys (ROWIDs) are monotonically increasing. Gaps in the ROWID integer sequence mathematically prove intentional deletion of communications, establishing spoliation under FRCP 37(e).
Recoverable Mobile Artifacts & Application Data
| Artifact Category | Database / File Target | Evidentiary Significance |
|---|---|---|
| SMS & MMS | sms.db |
Direct carrier messaging, delivery status timestamps, read receipts. |
| Apple iMessage | chat.db |
Multi-party group chats, unsent/edited message history, tapbacks. |
| WhatsApp Messenger | ChatStorage.sqlite / msgstore.db |
Encrypted communications, media hashes, call logs, live location pins. |
| Signal & Encrypted Apps | SQLCipher Keychain Decryption | Decryption of disappearing messages and ephemeral attachments. |
| Geotagged EXIF Telemetry | Photos.sqlite |
GPS latitude/longitude coordinates, altitude, lens and camera serials. |
| Call Detail Records | CallHistory.storedata |
Incoming, outgoing, missed, and third-party VoIP calls (FaceTime, WhatsApp). |
Evidentiary Defensibility & Courtroom Compliance
Digital evidence from mobile devices must satisfy strict state and federal statutory requirements to avoid exclusion or suppression:
- Federal Rule of Evidence 902(14): Our mobile forensic reports include self-authenticating digital certifications supported by simultaneous MD5 and SHA-256 cryptographic hash calculations.
- Texas Wiretap Act Compliance (Tex. Penal Code § 16.02): Extractions are strictly conducted with proper custodial consent, valid court orders, or subpoenas, ensuring full admissibility.
- Texas Occupations Code Chapter 1702: All examinations are conducted under our licensed Texas Department of Public Safety Private Security Board credential. Evidence collected by unlicensed IT contractors risks total exclusion under Texas law.