As part of your analysis of a legacy BlackBerry device, you examine the installed applications list and it appears that no third-party applications…

The BlackBerry Event Log (eventlog.dat) is a critical artifact for forensic analysis as it records a wide range of system and application activities. This includes timestamps for when applications were started and stopped, device power cycles, and connections to the BlackBerry Enterprise Server. Even if an application has been uninstalled and does not appear in the installed applications list, its execution history may still be preserved within these logs, providing direct evidence of which applications were accessed on the handset.

A. BlackBerry NV Items: These store non-volatile memory items related to device configuration, network settings, and hardware parameters, not logs of application usage.

B. Content Store: The ContentStore.dat file is a database containing user-generated data such as contacts, messages, and calendar entries, not a log of application execution events.

D. BBThumbs.dat: This file stores thumbnail caches for image and video files viewed on the device, which only indicates media access, not general application usage.

---

1. Angiulo, A., & Ayers, R. (2010). BlackBerry Forensics. SANS Institute InfoSec Reading Room. On page 11, the paper states, "The event log contains a wealth of information about what has happened on the device... This includes when applications were started and stopped, when the device was connected to the BES, and when the device was powered on and off." This directly supports the use of event logs for tracking application access.

2. Al-Husseini, M. (2010). BlackBerry Forensics: A Guide for the Mobile Forensic Examiner. SANS Institute InfoSec Reading Room. Page 14 explicitly details the value of the event log: "The event log is a very important file that contains a wealth of information about what has happened on the device. The event log records events such as when the device was powered on/off, when applications were started/stopped..."

3. Mislankar, A., & Dhavale, S. V. (2014). Forensic Analysis of BlackBerry Smartphone. International Journal of Computer Applications, 99(18), 1-5. In Section 3, "Forensic Analysis of BlackBerry," the authors note that the Event Log file "contains information about the events that have occurred on the device. This includes when applications were started and stopped." (DOI: [Not available, but widely cited in academic contexts for BlackBerry forensics]).