http://blogs.sans.org/computer-forensics/2009/10/22/recovering-deleted-text-messages-from-windows-mobile-devices/?utm_source=rss&utm_medium=rss&utm_campaign=recovering-deleted-text-messages-from-windows-mobile-devices SANS Computer Forensic Investigations and Incident Response Blog Tue, 16 Mar 2010 20:01:48 +0000 http://wordpress.org/?v=2.9.1 hourly 1 http://blogs.sans.org/computer-forensics/2009/10/22/recovering-deleted-text-messages-from-windows-mobile-devices/comment-page-1/#comment-5431 Evgueni Tchijevski Fri, 23 Oct 2009 09:03:31 +0000 http://blogs.sans.org/computer-forensics/?p=12091#comment-5431 There some other interesing things you can do on win mobile devices i.e.: You can read Registry hives (Default.hv and System.hv) with the tool from XDA MakeHv. You can read MMS with MMS-Parse (perl module). You can read pim.vol EDB database (Call registry and phonebook) with DBExplorer. if are able to read italian there's a tutorial on windows mobile forenisc with XDA tools. http://www.cfitaly.net/node/90 Regards There some other interesing things you can do on win mobile devices i.e.:
You can read Registry hives (Default.hv and System.hv) with the tool from XDA MakeHv.
You can read MMS with MMS-Parse (perl module).
You can read pim.vol EDB database (Call registry and phonebook) with DBExplorer.
if are able to read italian there’s a tutorial on windows mobile forenisc with XDA tools.
http://www.cfitaly.net/node/90
Regards

]]> http://blogs.sans.org/computer-forensics/2009/10/22/recovering-deleted-text-messages-from-windows-mobile-devices/comment-page-1/#comment-5396 Brad Thu, 22 Oct 2009 13:22:24 +0000 http://blogs.sans.org/computer-forensics/?p=12091#comment-5396 Did you mean to block out the ASCII numbers but leave the hex visible? Did you mean to block out the ASCII numbers but leave the hex visible?

]]>