BlackBerry Forums Support Community               

Closed Thread
 
LinkBack Thread Tools
Old 06-18-2006, 10:22 AM   #1 (permalink)
New Member
 
Join Date: Jun 2006
Model: NONE
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Question BlackBerry Log Files On PC Hard Drive....

Please Login to Remove!

Hey guys, gals.

I am student, who is currently on placement with a data recovery / forensics company. And i have been set a new task, which I need some advice with.

Basically I am investigating into the use of BlackBerry device on a PC.

The BlackBerry was connected to the PC, not necessarily syncronising, but was definately connected. Emails had been recevied either prior or while the BlackBerry was connected.

These emails are critical to the investigation. Where would I look on the suspect PC's hard drive for Logs stored by the BlackBerry. For example, MSN Messenger Logs are kept in a specific directory on the C:\ drive, is this the same for BlackBerry devices.

Would there be an area, encrypted or compressed where the information is stored. Do BlackBerry devices compress data, and if so does any one know what can be used except the BlackBerry to interrogate the information.

I dont have the BlackBerry device, neither do I have the make or model of the device. All i know is that at some point the Device was connected, and I am hopping that perhaps I can find some sort of Log of connectivity, log of activity etc that may help in this case.

Look forward to your replies, if any Thanks for reading

Cheers.

Icon_serf.
Offline  
Old 06-18-2006, 10:57 AM   #2 (permalink)
Thumbs Must Hurt
 
hbomb341's Avatar
 
Join Date: Dec 2005
Location: Flower Mound, Texas
Model: 8700C
Carrier: AT&T
Posts: 198
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

I also do forensics for a VERY large company. We have asked out self's the same questions. I have no clue your setup be in GENERAL we donxxx8217;t do that much with info on the device. You GENERAL can get the email off your Domino or Exchange Server. The EASIEST way and the best we have come up with is to try to get info off the blackberry is search for '.IPD' files the are backup files from the device. There isnxxx8217;t a log of data besides this. There is NO EASY way to praise the info out of it but you can load it up on a Blackberry Device Simulator and see it as the user will see it. BUT you will only have the info as far as the last Backup. There may be a password, but in my experience and our IT Policy it asks me to reset it so you will gain access to the data. If you want to go CRAZY and read an IPD file into something useful here is a site (http://www.blackberry.com/developers..._format.shtml), It CAN be done (WINK WINK). This has helped many of our clients but NEVER been the best thing in a case most just extra info. Form my experience from the server copy of e-mail, local copies of email, Blackberry data wasnxxx8217;t worth the cost to get it.

If you give us info on how the device was setup (BIS / BES), we can give you more insight. I am assuming if you are asking this question the e-mail server and backup have given you nothing. Also depending on your investigation I am not sure how large your scope is or what type of power you have on subpoenaing their ISP account (I assume was used on the BB).

Shoot me a pm if you want to chat about this I would be interested in more info just on a professional level and may be able to help.
__________________
-----------------
PIN: 2039CDD1
Offline  
Old 06-19-2006, 03:27 AM   #3 (permalink)
New Member
 
Join Date: Jun 2006
Model: NONE
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Hiya

Thanks for your posting, very helpful.

Im going to do a search on the suspect HDD for .IPD files. Also the link you posted seems to be broken. Any suggestions.

I will repost again soon and let you know the outcome.


Cheers, Icon_serf
Offline  
Old 06-19-2006, 03:29 AM   #4 (permalink)
Thumbs Must Hurt
 
hbomb341's Avatar
 
Join Date: Dec 2005
Location: Flower Mound, Texas
Model: 8700C
Carrier: AT&T
Posts: 198
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Quote:
Originally Posted by icon_serf
Hiya

Also the link you posted seems to be broken. Any suggestions.
Ya REMOVE the ')' at the end it should be http://www.blackberry.com/developers...e_format.shtml
__________________
-----------------
PIN: 2039CDD1
Offline  
Old 06-19-2006, 05:53 AM   #5 (permalink)
New Member
 
Join Date: Jun 2006
Model: NONE
Posts: 3
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

Ya, sorry - stupid mistake.

Okay, I have completed a search for .ipd files on the hard drive, but have found .idx instead. I believe that they are not relavent.

I guess this is a no win situation.

Cheers for your help though. Most appreciated.

icon_serf
Offline  
Old 06-19-2006, 05:55 AM   #6 (permalink)
Thumbs Must Hurt
 
hbomb341's Avatar
 
Join Date: Dec 2005
Location: Flower Mound, Texas
Model: 8700C
Carrier: AT&T
Posts: 198
Post Thanks: 0
Thanked 0 Times in 0 Posts
Default

An '.IDX' file is most often then not an Index file and just junk meta data. http://filext.com/detaillist.php?extdetail=IDX Were you unable to get the orignial mail file ... PST, OST, NSF ...?

I see from another board you are using EnCase 4, if the cusodian used webmail it would be well worh the invesment into upgrading to EnCase 5. I just got my updated dongles about 3 weeks ago and it beats the pants off 4.
__________________
-----------------
PIN: 2039CDD1

Last edited by hbomb341 : 06-19-2006 at 06:06 AM.
Offline  
Closed Thread


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On





Copyright 2004-2014 BlackBerryForums.com.
The names RIM and BlackBerry are registered Trademarks of BlackBerry Inc.