Most mobile phones store text messages in a SQLite database, but the database format is where any similarities stop. Table structures, schemas and structures all vary widely and damage to the database can be difficult to overcome.

Before any data recovery can begin we always take a raw image using a write-blocker, meaning that we cannot alter the data in any way. This is essential in computer forensics and certainly useful for data recovery. We know that if unsuccessful, our engineers can always revisit the original media and start again.

Once we have a clean sweep of the raw data, manual evaluation and analysis will determine the definition of the database and calculate the data parameters. Put simply, our data recovery engineers will decipher how texts are stored, the components of each fields, timestamps, geo-location and message body.

Using proprietary software that we have developed ourselves, the engineers will identify the appropriate hexadecimal code for each text message and write a script to extract the various components and reorder them into an individual record. If we define the components incorrectly, we will be presented with garbled data on completion. So it is absolutely essential that we make no errors at this stage.

Once all the data is extracted, we must verify and test the recovered information. We reconcile this against hexadecimal in the raw image and complete a random physical test. If in doubt, we refer to the user and discuss our findings to ensure it meets their approval.