±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 0 Visitors: 270

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Sony Ericsson Sent SMS Date/Time

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2  Next 
  

KVS379
Member
 

Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 12, 09 01:16

Hi All,

A particular exhibit which I am working on is a Sony Ericsson and as with all Sony Ericssons the date and times of Sent SMS are never extracted.

This occurs on all the tools I have used; XRY, Paraben, Oxygen, Cellebrite.

Does anyone know why this is and does anyone know if there is a solution to this problem? Obviously, without having to manually transcribe each individual message.

Thanks,

Regards,

KVS  
 
  

AlexC
Senior Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 15, 09 15:28

Having spoken to Robert at MSAB about this in the past - it is apparently down to the protocol used to extract calls on Sony Ericssons (GSM0705 off the top of my head - but don't quote me on that!).

You'll get the same thing with most LGs which also use the same protocol. It's not a limitation of the software as such - just the protocol.  
 
  

trewmte
Senior Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 15, 09 17:15

AlexC GSM0705 is one of a number of standards to look at for SMS text messages. The format for SMS text messages headers are pretty standard so I am puzzled why it is suggested to you that somehow the header of the text message has been truncated and removed from body of message or not supplied by the handset due to protocol?

I do not see how it is a protocol issue, unless you mean the protocol used within the handset software readers are not calling and fetching the data using a protocol that the handset itself understands. Which makes it a handset software reader ("XRY, Paraben, Oxygen, Cellebrite") problem and not a protocol problem of the handset itself per se, which I should add displays the date and time stamps quite adequately.
_________________
Institute for Digital Forensics (IDF) - www.linkedin.com/groups/2436720
Mobile Telephone Examination Board (MTEB) - www.linkedin.com/groups/141739
Universal Network Investigations - www.linkedin.com/groups/13536130
Mobile Telephone Evidence & Forensics trewmte.blogspot.com 
 
  

AlexC
Senior Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 15, 09 18:12

Is it possible to "spy" on the AT commands sent to, and the responses given by the handset?

I would be interested in investigating whether the handset replies with anything looking like a time-stamp for these messages.

Might it be possible to "talk a different language" to the handset in order to get these timestamps?

I'm fully aware that the handset displays the date stamp, and from what I remember from investigating test Sony Ericsson handsets' file system (a little forcefully!) the timestamps were present and correct - whether they were in the standard GSM-esque format I can't remember; probably though - as I don't recall having any great deal interpreting them.  
 
  

KVS379
Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 15, 09 18:25

Cheers for the replies guys.

From both your answers I suppose it is safe to assume that no solution is available yet.

However, how is it that these leading mobile forensic software suites are all lacking in this particular area? Does it come down to the actual mobile phone software?  
 
  

burratha
Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 17, 09 14:40

Greg,

I appreciate what you're saying and I agree with your comments in the main, however I would suggest that the issues raised in this thread generally relate to outgoing SMS.

I do think, however, that how a handset sends the data over the network, and how it stores its own self-generated data (ie. SMS created on the device) are different. Incoming SMS information is generally taken from the SMS packet, therefore would "normally" be stored as a standard form.

Example:

* Nokia S40 handsets generally store incoming SMS timestamps as YYMMDDHHMMSS (reverse nibbled) however outgoing messaged are stored in a different format, and only then when the internal clock is set.
* iPhone - all SMS data is stored in SQlite databases
* BlackBerry - again, stored in databases

However, all these devices comply with the standards when they send the data over the network - let's face it, they would have to or the message wouldn't be transmitted. Would it?

It seems the this Sony Ericsson is no different - with outgoing timestamps and their relationship to the respective message being stored in a proprietory format.

Food for thought/discussion?  
 
  

AlexC
Senior Member
 

Re: Sony Ericsson Sent SMS Date/Time

Post Posted: Jun 17, 09 15:54

I emailed Robert at MSAB again, for some clarification and he sent me a useful link that I think goes some way to explain the limitation.

www.developershome.com...ommand.asp

If you scroll down to the section titled: "26.2.2. Format of the Information Response of the +CMGR AT Command in SMS Text Mode"

and look at the response format for incoming:

+CMGR: message_status,address,[address_text],service_center_time_stamp[,address_type,TPDU_first_octet,protocol_identifier,data_coding_scheme,service_center_address,service_center_address_type,sms_message_body_length]<CR><LF>sms_message_body

and outgoing:

+CMGR: message_status,address,[address_text][,address_type,TPDU_first_octet,protocol_identifier,data_coding_scheme,[validity_period],service_center_address,service_center_address_type,sms_message_body_length]<CR><LF>sms_message_body

messages (the square brackets are optional fields) you'll notice that the SMSC Timestamp is omitted from the outgoing response. (The validity period doesn't appear in the Incoming response).

So it appears that by using this particular set of AT commands you can never get a timestamp for outgoing messages - the handset stores them, true enough, but you'd have to get at them another way.

It makes me wonder how SE's own software addresses the SMS (you can do a backup of all the SMS with it). Does it extract the dates for the (sent) messages? And if it does what "language" is it speaking to the handset?



(edited to remove the code tags that were needlessly stretching the screen!)  
 

Page 1 of 2
Page 1, 2  Next