Type Icing MMS SMS
Jump to navigation
Jump to search
| Defined Constant | Type_Icing_MMS_SMS
|
| File Type Value | 975 |
| Parent Type | SQLite |
| Carve | Yes |
| Format Details | Yes |
| MIME Type | application/vnd.sqlite3
|
| Filename Extension | db
|
Icing MMS SMS
Description
Android Icing MMS data
Truxton Exploiters
This file type is handled by the following ETLs:
Items Produced
Truxton will extract the following from this file type:
- Files
- Messages
- Type_File_Details
- Type_SQLite_Sample
Details
We have seen several versions of this database.
Queries
Here's the queries Truxton uses to exploit the Icing MMS/SMS databases.
SMS
Sometimes the [sms] table doesn't exist in the database.
SELECT [address],[date],[body],[type] FROM [sms]
Other times you must pull the SMS messages from the [mmssms] table.
We do this when the [mmssms] tables does not contain a column named [attachment_data].
SELECT [_id],[msg_type],[address],[date],[body] FROM [mmssms] WHERE [msg_type] = 'sms'
Or
SELECT [address],[date],[date_sent],[body],[attachment_data],[_id] FROM [mmssms]
