Type Android Messages

<< Details >>

Defined Constant	Type_Android_Messages
File Type Value	762
Parent Type	SQLite
Carve	Yes
Format Details	Yes
MIME Type	application/vnd.sqlite3
Filename Extension	db

Android Messages

Description

Android Message Database

Truxton Exploiters

This file type is handled by the following ETLs:

• Expand

Items Produced

Truxton will extract the following from this file type:

• Type_File_Details
• Type_SQLite_Sample
• Messages

Filenames Seen

• bugle_db (bugle)
• message.db

Queries

Original

These queries are used for the version of the database that contains a [message] table.

Get Messages

This query figures out who the owner of the device is.

SELECT [message].[time], [message].[from_addr], [message].[to_addr], [text_content].[c2body] 
FROM [message] 
LEFT OUTER JOIN [text_content] ON ([message].[native_id] = [text_content].[docid]) 
ORDER BY [message].[time]

2019 09

These queries are used for the version of the database that contains a [messages] table.

Get Owner

This query figures out who the owner of the device is.

SELECT [normalized_destination] FROM [participants] WHERE [sim_slot_id] = 0 ORDER BY [_id] LIMIT 1

Get Messages

This query retrieves the messages. When [sim_slot_id] is zero, it means that message was sent from the device.

SELECT [messages].[_id], 
  [parts].[text], 
  [parts].[timestamp], 
  [participants].[sim_slot_id], 
  [conversations].[participant_normalized_destination], 
  [conversations].[name] 
FROM [messages]  
LEFT JOIN [parts] ON [messages].[_id] = [parts].[message_id] 
LEFT JOIN [participants] ON [messages].[sender_id] = [participants].[_id] 
LEFT JOIN [conversations] ON [messages].[conversation_id] = [conversations].[_id] 
ORDER BY [parts].[timestamp]