When examining a file system acquisition of an Android device Which artifact must be carved out manually?

While modern forensic tools can automatically parse the primary SQLite database for SMS messages (mmssms.db), remnants of messages may exist outside this structured file. These remnants, particularly in unallocated space or memory dumps, can be in the raw Protocol Data Unit (PDU) format. PDU is a complex hexadecimal encoding for SMS data defined by 3GPP standards. Forensic tools may not always identify or correctly decode these raw PDU strings, compelling an examiner to manually search for, extract (carve), and decode them to recover the message content. This manual decoding process is more complex than parsing other database artifacts or automated file carving.

A. Deleted images: The process to recover deleted images from unallocated space is called file carving, but it is heavily automated by modern forensic tools that search for known file headers and footers.

B. Contacts: Contact information is stored in a well-structured SQLite database (contacts2.db) with data in straightforward text and numeric fields, which are easily and automatically parsed by forensic software.

D. Phone numbers: Phone numbers, found in call logs (calllog.db) or contacts, are stored as plain text or numbers in SQLite databases, making automated extraction a standard and reliable process.

---

1. 3GPP TS 23.040, Technical realization of the Short Message Service (SMS): This official standard defines the PDU format. Section 9.2, "Transfer-layer data," specifies the intricate structure and hexadecimal encoding for SMS-SUBMIT and SMS-DELIVER PDUs, which require specialized knowledge to decode manually. This demonstrates the complexity that necessitates manual intervention when raw PDU data is found.

2. Al-khassawneh, M., & Othman, S. O. (2015). An approach for recovering deleted SMS from Android mobile phone. 2015 International Conference on Computer, Communications, and Control Technology (I4CT). This paper discusses the process of recovering deleted SMS messages by searching for specific data patterns within the unallocated pages of the SQLite database file itself, illustrating a low-level recovery method that is more manual than typical automated parsing. (DOI: 10.1109/I4CT.2015.7219579)

3. Hoog, A. (2011). Android Forensics: Investigation, Analysis, and Mobile Security. Syngress Publishing. Chapter 6, "Analyzing Android Applications," details the standard locations for artifacts like contacts and SMS messages in their respective SQLite databases, highlighting their structured nature which lends itself to automated parsing, while implicitly contrasting this with the recovery of data from unstructured or raw sources.