Thought your deleted text messages were gone forever? Think again!
Apparently criminals don’t all use iPhones, which has led to the development of forensic tools for the Windows Mobile operating system.
A blog post at SANS.org describes how one can recover deleted text messages, which of course is not only useful to CSI but occasionally to regular users like us who accidentally deleted a message before reading it.
The process is far from straightforward, but in essence requires reading the cemail.vol file, which like many other databases do not immediately overwrite data but simple removes pointers to it.
Some information can be read simply by using a HEX editor, but for a better view mounting the file in the Windows Mobile emulator may be more useful.
Can anyone think of a few scenarios where this capability may be handy? Let us know in the comments.
Read the full details at SANS.org here.
Sphere: Related Content
Posted in 
Tags: 
You could also look in the "Deleted Items" Folder.
[Reply]
Now, I could track the "delete" messages from my wife
[Reply]