Type Android MMS SMS Database

From truxwiki.com
Jump to navigation Jump to search
<< Details >>
Defined Constant Type_Android_MMS_SMS_Database
File Type Value 761
Parent Type SQLite
Carve Yes
Format Details Yes
MIME Type application/vnd.sqlite3
Filename Extension db

Android MMS SMS

Description

Android MMS SMS Database

Truxton Exploiters

This file type is handled by the following ETLs:

Items Produced

Truxton will extract the following from this file type:

Filenames Seen

  • mmssms.db

Details

Queries

Here's the queries Truxton uses to exploit Signal databases.

Owner

It is assumed that the owner of the device is record number 1 ([_id] is 1) in the [addr] 

SELECT [_id],[address],[timestamp] FROM [addr] ORDER BY [_id]

SMS

The [reply_path_present] column has a value when the [address] is the sender of the message. When it is a null column, the owner is the sender of the message. 

SELECT [address],[date],[body],[reply_path_present] FROM [sms]

MMS

The [st] column has a value of 1 when the [address] is the sender of the message. 

SELECT [mms].[date], 
  [mms].[address],
  [mms].[st],
  [part].[ct],
  [part].[data_size],
  [part].[_data]
FROM [mms]
JOIN [part] ON ([mms].[_id] = [part].[mid])
ORDER BY [mms].[date]
Retrieved from "https://truxwiki.com/index.php?title=Type_Android_MMS_SMS_Database&oldid=10675"