Okuzza obubaka obujulizi okuva ku ssimu eyonoonese oba chat backup eyonoonese¶

Omusango gw’obwannannyini ogw’amaanyi, olutalo lw’okulabirira abaana mu kkooti y’amaka, okuwulira ekiragiro ekikugira, okwemulugunya ku kutulugunyizibwa ku mulimu, enkaayana z’abafere abakola kontulakiti, oba okwewozaako ku misango bwe kwesigama ku bubaka ku ssimu, okukubaganya ebirowoozo ku WhatsApp, iMessages, oba obuwuzi bwa Signal obusibiddwa munda mu ssimu emenyese oba fayiro ya backup eyonoonese, okunyiga omulundi gumu mu bukyamu kuyinza okusaanyaawo obukakafu bwo obw’amateeka enkalakkalira. Database z’obubaka ez’omulembe tezitereka bubaka nga fayiro z’ebiwandiiko ennyangu; bazitereka munda mu nkolagana SQLite databases (sms.db ku iOS, . mmssms.db / . bugle_db ku Android, msgstore.db.crypt14 / . crypt15 ku WhatsApp, ne database za SQLCipher ku Signal) nga ziwerekerwako Write-Ahead Log (.db-wal) fayiro za jurnal.

Singa mu butanwa oleka essimu empya okuwandiika ku backup yo ey’ekire emu ne database empty, oba singa oggulawo database ya SQLite eyonoonese nga tokoppa hidden yaayo -wal fayiro okusooka, oba singa ossaayo ebifaananyi ebisaliddwako, ebitali bikakasibwa, munnamateeka gw’awakanya by’awakanya ng’ebicupuli, oyinza okufiirwa byombi data n’omusango gwa kkooti.

Ekitabo kino kiwa mutendera ku mutendera okuggya emboozi ezitali za kusaanyaawo, okuddaabiriza database ya SQLite, okuzzaawo cryptographic backup, n’enkola z’okukuuma eby’okunoonyereza ku misango ezikkirizibwa kkooti nga zeesigamiziddwa ku National Institute of Standards and Technology (NIST) Special Publication 800-101 Rev. 1 (Guidelines on Mobile Device Forensics), Federal Rules of Evidence (FRE) Rules 901(b)(9) ne 902(14) (Okwekakasa Obujulizi obw’Ebyuma Nga Buyita mu SHA-256 Hash Certification), n’ebiragiro ebitongole eby’okuzzaawo SQLite / SQLCipher.

Kino kikole kati¶

Bw’oba ​​weetaaga okununula obubaka obukulu obw’okuwandiika oba obw’okukubaganya ebirowoozo okuva ku ssimu eyonoonese, thread eyasazibwamu mu butanwa, oba backup eremereddwa:

1. Essimu giteeke mu Airplane Mode amangu ddala era OFF automatic iCloud / Google Drive Backup. Lino lye tteeka #1 erya mobile forensics. Lwaaki? Ekisooka, bw’osazaamu obubaka mu iMessage (sms.db), WhatsApp (msgstore.db), oba Obubaka bwa Android, ekiwandiiko tekisangulwa mangu ku flash drive, kituula munda mu SQLite database's "Freelist / Unallocated Pages" oba munda mu Write-Ahead Log ey'ekiseera (.db-wal) okutuusa nga database ekola background VACUUM okuyonja oba okukola obubaka obupya waggulu waakyo. Ekirala, singa obubaka bwasazibwamu ku ssimu yo leero, iCloud Backup oba Google Drive WhatsApp Backup eya 02:00 AM ekiro ekyakeesezza olwaleero ekyalimu obubaka obutafudde, okutuusa ekiro kya leero automatic Wi-Fi backup bw'ebuwandiika. Okutandika Airplane Mode kiyimiriza byombi okuwandiika SQLite ey'omu kitundu n'okuwandiika ku cloud backup mu bwangu. Bw’oba ​​oli mu bulabe obw’amangu obw’omubiri okuva eri omutulugunya w’awaka oba omugoberezi w’obubaka bwe bw’okuuma, sooka otuuke mu kifo ekitali kya bulabe era okubire ku nnamba y’amangu mu kitundu kyo (911 mu Amerika ne Canada, 112 okwetoloola omukago gwa Bulaaya, 999 mu Bungereza) oba okebere ennamba z’amangu.
2. Tossaako oba kuyingira mu WhatsApp oba Signal ku ssimu empya n'onyiga "Back Up Now" nga tonnazzaawo archive yo enkadde. Obukadde n'obukadde bw'abakozesa bafiirwa obujulizi bwa WhatsApp obw'emyaka nga bateekawo essimu ey'okukyusa: singa obuuka ekiragiro ekisooka eky'okuzzaawo (oba singa okuzzaawo kulemererwa ku bitundu 99 ku buli 100) ate WhatsApp empya etaliimu kintu kyonna n'ekola automatic backup ku Google Drive oba... iCloud, ewandiika ku backup yo ey'ebyafaayo ey'ekire eya gigabyte eziwera ne 0-kilobyte blank backup.
3. Singa screen y’essimu eba eddugavu oba ekutuse (touch digitizer emenyeke) naye ng’essimu ekyakankana oba ng’ekuba enduulu, TOGIddamu kugitandika. Ku iOS ne Android zombi (File-Based Encryption / Before First Unlock - BFU vs After First Unlock - AFU), kasita essimu ebadde esumuluddwa omulundi gumu okuva lwe yasembayo okuddamu okutandika (AFU state), ebisumuluzo by’okukuuma obubaka bwo bitudde nga bifuuliddwa mu RAM, ekikusobozesa okussa mu $15 USB-C / Lightning hub nga olina mouse ya kompyuta ya USB eriko waya ne HDMI monitor okunyiga "Trust This Computer" era osika backup ya wano enzijuvu. Bw’okaka okuddamu okutandika essimu ng’erina screen emenyese, egwa mu BFU locked state nga wadde USB mouse oba computer tesobola kugisumulula nga tesoose kulongoosa screen (laba guide yaffe ku okuzzaawo essimu eyamenyese oba eyonoonese amazzi).
4. Buli lw’okoppa database ya SQLite embisi (sms.db oba msgstore.db), BULIJJO kkoppa fayiro z’abooluganda essatu wamu (.db, . .db-wal, era .db-shm). Buli database y'obubaka ku ssimu ey'omulembe ekola mu mbeera ya SQLite WAL (Write-Ahead Logging). Ennaku oba wiiki zo ezisembyeyo ez’obubaka zitera okuba nga zitudde munda mu munno sms.db-wal oba msgstore.db-wal fayiro, SSI munda mu kikulu .db fayiro n'okutuusa kati. Bw’oba ​​okoppa yokka sms.db era n’ogenda sms.db-wal emabega, obubaka obusembyeyo bubula oba database eggulawo nga eyonoonese.
5. Bala era owandiike cryptographic SHA-256 hash ya fayiro yonna eya backup oba database efulumiziddwa amangu ddala. Nga tonnaba kwekenneenya oba okukyusa fayiro yonna eya backup ezuuliddwa, dduka sha256sum (Linux/macOS) oba Get-FileHash -Algorithm SHA256 (Windows PowerShell) ku archive eyasooka era otereke omuguwa gwa hash ogw'ennukuta 64. Mu Federal Rule of Evidence 902(14), omuwendo gwa hash ogwa SHA-256 gwe mutindo gwa zaabu ogw’okukakasa mu kkooti nti tterekero lyo ery’obubaka bwa digito tekyusiddwako oba okukolebwako ebifaananyi.

flowchart TD
    A["Obwetaavu obw'amangu Okuzzaawo & Okukuuma Obubaka Obujulizi (SMS, iMessage, WhatsApp, Signal)"] --> B["IMMEDIATE FREEZE: Ssobozesa Airplane Mode ku ssimu & lema auto-cloud backup ku byuma ebirala"]
    B --> C{"Embeera y’essimu n’obubaka eri etya mu kiseera kino?"}
    C -->|"1. Essimu ekola, naye obubaka bwasazibwamu mu butanwa"| D["Kebera oba Cloud Backup (iCloud / Google Drive) oba Local WhatsApp '/Databases' folda erina ekifaananyi ekisooka okusazaamu"]
    D --> E["Nga tonnazza ku ssimu butereevu: Sooka otwale Full Local Encrypted Backup ku PC/Mac (`idevicebackup2` / iTunes / Finder / ADB) okukuuma enkalala za SQLite WAL ez'eddembe"]
    C -->|"2. Screen y’essimu emenyese / eddugavu, naye board ekyakola"| F["TOddamu kutandika (Kuuma mu mbeera ya 'After First Unlock'); kwata USB-C/Lightning Hub + Wired USB Mouse + HDMI Display okusumulula & okukkiriza PC backup"]
    C -->|"3. Fayiro ya Chat Backup oba database ya SQLite (`sms.db`, ​​`msgstore.db`, ​​Signal) eyonoonese / eremereddwa okuzzaawo"| G["Koppa fayiro ZONNA ESATU (`.db`, ​​`.db-wal`, `.db-shm`) mu dayirekita ekola ku PC/Mac"]
    G --> H{"Database eriko ensirifu (`crypt14/crypt15` oba SQLCipher) oba SQLite eya bulijjo?"}
    H -->|"WhatsApp / Siginini eriko ensirifu"| I["Decrypt nga okozesa Ekisumuluzo kya E2EE ekya 64-char / `/data/data/com.whatsapp/files/key` (`wa-crypt-tools`) oba Signal ekigambo ky'okuyita ekya digito 30 (`signalbackup-tools`)"]
    H -->|"Decrypted / SQLite eya mutindo"| J["Ddabiriza empapula za B-tree ezonoonese ng'okozesa `sqlite3 .recover` oba okuyoola ebiwandiiko ebisaziddwamu okuva mu Freelist & WAL frames"]
    E --> K["Okukakasa ku Kkooti: Okukola SHA-256 Hash + Full-Thread PDF ne Carrier CDRs + FRE 902(14) Ekirangiriro"]
    I --> K
    J --> K

Enzimba y’okutereka obubaka ku ssimu: Obubaka bwo we bubeera mu butuufu¶

Okuzzaawo obubaka obusaziddwamu oba obwonooneddwa nga tobusaanyizzaawo, olina okutegeera buli nkola y’emirimu n’omukutu gw’obubaka we bitereka database yaayo entuufu, ebisumuluzo byayo eby’okusiba, n’ebitereke byayo eby’omu kitundu ebiyiringisibwa:

Ensonga 1: Okuzzaawo obubaka bwa iPhone obwasanguddwa oba obwonooneddwa (sms.db & ChatStorage.sqlite) .¶

Singa iMessages enkulu, obubaka bwa SMS, oba obubaka bwa WhatsApp bwasazibwamu ku iPhone, oba singa iPhone eyonoonese, goberera emitendera gino gyennyini mu nsengeka y’okukulembeza:

Omutendera 1: Kebera ekifo ekizimbibwamu iOS "Recently Deleted" vault (Ennaku 30 okutuuka ku 40 ezisooka)¶

Ku iOS 16, iOS 17, iOS 18, n'empya, okusazaamu ekiwandiiko oba iMessage thread te kitambuza mangu mu raw SQLite freelist space; kigitambuza mu folda ya kasasiro enkweke okumala ennaku 30 (okutuuka ku nnaku 40 nga tezinnaba kulongoosebwa enkalakkalira): 1. Ggulawo app ya Messages ku iPhone. 2. Koona ku Edit (oba Filters) mu nsonda eya waggulu ku kkono. 3. Koona ku Laga Ebyakaasazibwamu. 4. Londa emboozi era onyige ku Recover.

Omutendera 2: Ggyayo sms.db era ChatStorage.sqlite okuva ku Local Mac / Windows Backup nga towandiise kintu kyonna¶

Singa obubaka bwasazibwamu enkalakkalira okuva mu "Recently Deleted" (oba bw'oba weetaaga okuggya obubaka bwa kkooti oba okuyoola ennyiriri za SQLite ezisaziddwamu), kola backup ya wano enzijuvu ku kompyuta amangu ddala ng'essimu ekyali mu Airplane Mode:

1. Yyunga iPhone ng’oyita mu waya ya USB ku Mac (Finder) oba Windows PC (Apple Devices / iTunes) oba Linux (libimobiledevice):
2. Laga akabokisi akalaga "Encrypt local backup" era oteekewo ekigambo ky'okuyingira eky'enjawulo ky'otogenda kwerabira (nga Evidence1234). (Lwaki okusobozesa okusiba okutereka? Okutereka kwa iOS okw’omu kitundu okusibi kulimu ebintu ebirala eby’okunoonyereza ku misango, data y’ebyobulamu, ebyafaayo by’okuyita, n’ebintu eby’omu kisumuluzo Apple by’eggyamu ebikuumi ebitali bikuumibwa).
3. Nywa ku Back Up Now olinde okuggwa.
4. Funa folda ya raw backup ku kompyuta yo:
5. macOS: -/Library/Application Support/MobileSync/Backup/<UDID>/
6. Amadirisa: %APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\ oba %USERPROFILE%\Apple\MobileSync\Backup\<UDID>\
7. **Koppa ekyo kyonna <UDID> folda ku External Drive ey’enjawulo amangu ddala era obazeeko hash yaayo eya SHA-256 ** kale ekifaananyi kyo eky’okunoonyereza ekyasooka tekiyinza kukyusibwa.
8. Funa database z'obubaka entuufu munda mu iOS Backup ng'okozesa Apple's SHA-1 Domain Hashes:
9. Apple ekyusa amannya ga buli fayiro munda mu iOS backup okudda ku SHA-1 hash yaayo Domain-RelativePath, esengekeddwa mu subdirectories ez'ennukuta bbiri:
   • Ekitabo ky'obubaka bwa Apple / iMessage Database (HomeDomain-Library/SMS/sms.db): Esangibwa ku subfolder 3d/ -> fayiro 3d0d7e5fb2ce288813306e4d4636395e047a3d28 **
   • Ekifo eky'okuterekamu amawulire ekya iOS ekya WhatsApp (AppDomainGroup-group.net.whatsapp.WhatsApp.shared-ChatStorage.sqlite): Esangibwa ku subfolder 7c/ -> fayiro 7c7fba66680ef796b916b067077cc246adacf01d **
   • Omuko gwa Fayiro za Backup (Manifest.db): Omuko gwa SQLite omukulu ogukola maapu ya buli kifaananyi kimu, ekiwandiiko ky'eddoboozi, ne hash y'okugattibwa ku linnya lyayo erya fayiro erya nnamaddala mu SMS/Attachments/.
10. (Bw'oba wasobozesa okusiba eby'okutereka, okuggya kkopi ekola eya backup mu folda esomebwa ng'okozesa ebikozesebwa ebiggule nga iphone-backup-decrypt mu Python oba abalabi ba wano abamanyiddwa nga iMazing oba iBackup Viewer). ) .

Ensonga 2: Okuzzaawo WhatsApp ya Android .crypt14 / . .crypt15 ne Signal .backup ebifo eby’edda¶

1. Okununula WhatsApp backup enkadde nga rolling window ya nnaku 7 tennaggwaako¶

Watya singa omuntu yasazaamu emboozi ya WhatsApp ekulumiriza ku ssimu yo eya Android ennaku 3 eziyise, ate ekiro ekyakeesezza olwaleero ku ssaawa 02:00 AM Google Drive backup yawandiika dda ku cloud copy? - Teeka essimu yo eya Android mu kompyuta ng’oyita mu USB (mu File Transfer / MTP mode) oba ggulawo app ya Android Files ogende ku:

Internal Storage/Android/media/com.whatsapp/WhatsApp/Databases/

2. Okuggya ensirifu mu ngeri eyonoonese .crypt14 / . .crypt15 WhatsApp backups ku kompyuta (wa-crypt-tools) .¶

Watya singa fayiro ya WhatsApp backup egwa ku bitundu 95 ku 100 mu kiseera ky’okuzzaawo essimu kubanga database ya SQLite munda mu encrypted wrapper eyonoonese katono? Osobola okuggya ensirifu mu... .crypt14 oba .crypt15 container butereevu ku kompyuta yo, ddaabiriza database ya SQLite, era osome buli bubaka: - Bw'oba olina a .crypt15 End-to-End Encrypted Backup era n'otereka ekisumuluzo kyo ekya 64-digit hexadecimal (oba bw'oba oggyeemu /data/data/com.whatsapp/files/key oba encrypted_backup.key), teeka ekintu ekiggule ekya Python forensic tool ** .wa-crypt-tools (wagolek)**:

# Install wa-crypt-tools on Linux, macOS, or Windows Python:
python3 -m pip install wa-crypt-tools

# Decrypt a WhatsApp .crypt15 backup using your 64-character hex key:
wadecrypt <your_64_character_hex_key> msgstore.db.crypt15 msgstore.db

# Or decrypt a .crypt14 backup using the extracted 158-byte key file:
wadecrypt key msgstore.db.crypt14 msgstore.db

3. Okuggyamu n’okuddaabiriza Signal eyonoonese .backup oba database ya Signal Desktop¶

• Ku lwa Android signal-YYYY-MM-DD.backup fayiro: Singa essimu empya egaana okuyingiza fayiro ennene eya Signal backup (oba singa fayiro yasalibwako nga ekoppa ku SD card egenda okufa), kozesa ekintu ekiggule eky’okunoonyereza ku misango signalbackup-tools (github.com/bepaald/signalbackup-tools) ne 30-digit numeric backup passphrase yo okusumulula fuleemu ezitayonoonebwa, okufulumya database ya SQLite embisi, n'okukola archive y'emboozi ya HTML ennyonjo, enoonyezebwa nga byonna ebigattibwako emikutu tebiriiko kamogo:

  # Unpack a Signal Android backup (including truncated/partially corrupted archives) to HTML:
  signalbackup-tools signal-2026-10-30.backup "12345 67890 12345 67890 12345 67890" --exporthtml ./recovered_signal_chats/
  

• Ku Desktop ya Signal (-/.config/Signal/sql/db.sqlite): Ne bwe kiba nti essimu yo ey’omu ngalo yabetenteddwa mu kabenje k’emmotoka oba n’esuulibwa mu nnyanja ate ng’olina zero phone backups, singa laptop yo ebaddeko Signal Desktop linked, copy the entire Signal application directory (%APPDATA%\Signal ku Windows, . -/Library/Application Support/Signal ku macOS, oba -/.config/Signal ku Linux) nga tonnaggulawo app, n'okufulumya database ya SQLCipher ng'okozesa signalbackup-tools oba sqlcipher.

Ensonga 3: Okuddaabiriza database ya SQLite chat eyonoonese (database disk image is malformed) n’okuyoola ennyiriri ezisaziddwamu¶

Essimu bw’efiirwa amaanyi ga bbaatule wakati write oba ng’efuna ensobi mu kutereka flash, okugguka sms.db, . ChatStorage.sqlite, oba msgstore.db esuula ensobi ya SQLite etta: Error: database disk image is malformed (SQLITE_CORRUPT)

Tokolangako shareware ya "paid SQLite fixer" ey'ekika eky'okusatu esaanyaawo ku database yo eyasooka. Kozesa SQLite entongole .recover ekiragiro ekizimbibwa butereevu mu sqlite3 (version 3.29.0+), esika empapula za database eza kilobyte 4 embisi emu ku emu ng’eyita ku biraga omuwendo gwa B-tree ebimenyese:

Omutendera ku mutendera SQLite .recover n’okuddaabiriza ebifo ebikeberebwamu ebya WAL¶

1. Kola kkopi ekola eya fayiro zonna essatu eza database (.db, . .db-wal, . .db-shm) mu folda empya:

   mkdir ~/chat_rescue && cp sms.db* ~/chat_rescue/ && cd ~/chat_rescue/
   

2. Ddukanya SQLite entongole .recover ekiragiro okuddamu okuzimba database ennyonjo (n'okukwata ennyiriri ezibula/ez'eddembe):

   # Standard recovery of all intact tables and rows into a brand-new healthy database:
   sqlite3 sms.db ".recover" | sqlite3 sms_repaired.db
   
   # FORENSIC DELETED-ROW RECOVERY: Add the --ignore-freelist flag so SQLite ALSO recovers
   # deleted message fragments still sitting inside unallocated freelist pages into a 'lost_and_found' table:
   sqlite3 sms.db ".recover --ignore-freelist" | sqlite3 sms_forensic_with_deleted.db
   

3. Funa ebweru w'eggwanga ekiwandiiko kya CSV/HTML ekisomebwa abantu, ekigoberera ebiseera okuva mu database eddaabiriziddwa:
4. Ku Apple iOS sms.db (Okukyusa Apple's CoreData Nanosecond Timestamp okuva nga Jan 1, 2001 okudda mu UTC/Olunaku lw'Ekitundu):

   sqlite3 -header -csv sms_repaired.db "
   SELECT
       m.ROWID AS MsgID,
       datetime(m.date / 1000000000 + 978307200, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.is_from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       h.id AS Contact_Phone_Or_Email,
       m.service AS Service_Type,
       m.text AS Message_Body,
       a.filename AS Attachment_Path
   FROM message m
   LEFT JOIN handle h ON m.handle_id = h.ROWID
   LEFT JOIN message_attachment_join maj ON m.ROWID = maj.message_id
   LEFT JOIN attachment a ON maj.attachment_id = a.ROWID
   ORDER BY m.date ASC;
   " > recovered_imessage_transcript.csv
   

5. Ku WhatsApp ku Android msgstore.db (Munnakuzino message ensengeka y'emmeeza):

   sqlite3 -header -csv msgstore_repaired.db "
   SELECT
       m._id AS MsgID,
       datetime(m.timestamp / 1000, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       jid.raw_string AS Chat_Or_Sender_JID,
       m.text_data AS Message_Body
   FROM message m
   LEFT JOIN chat c ON m.chat_row_id = c._id
   LEFT JOIN jid ON c.jid_row_id = jid._id
   ORDER BY m.timestamp ASC;
   " > recovered_whatsapp_transcript.csv
   

Okufuula obubaka bwo obuzuuliddwa okukkirizibwa 100% mu kkooti (Okwewala okuwakanya "Fake Screenshot")¶

Buli wiiki mu kkooti y’amaka, kkooti y’okuwoza emisango emitonotono, okuwulira ebiragiro ebiziyiza, n’emisango egy’enjawulo, abantu batambula okutuuka ku mulamuzi nga balina ebifaananyi bya ssimu eby’omu ngalo ebikalu, ebisaliddwako ng’omutwe gw’omuntu gw’akwatagana naye gugamba nti erinnya ly’ekika nga "Ex-Husband" oba "Landlord Mike" nga tewali nnamba ya ssimu era nga tewali nnaku ntuufu. Bannamateeka abawakanya amangu ago bawakanya wansi wa Federal Rule of Evidence 901 (Lack of Authentication) ne Rule 106 (Rule of Completeness), nga bagamba nti omuntu yenna asobola okukyusa erinnya ly’essimu eyookubiri eya prepaid "Landlord Mike" mu contacts app yaabwe ne beeweereza obubaka obw’ebicupuli mu sikonda 30.

Olukalala lw’okukebera okukakasa mu kkooti ey’ensonga 5 olw’obujulizi bw’ebiwandiiko n’okukubaganya ebirowoozo¶

1. Sazaamu oba Kyuusa Erinnya ly'Erinnya ly'Omukwatagana Nga Tonnafulumya/Ku Screenshotting kale Raw Phone Number (+1-555-019-2834) oba Email Efulumira mu Buli Mutwe:
2. Nga tonnakwata bifaananyi bya backup (oba ekisinga obulungi, kozesa ekintu ekijjuvu eky'okufulumya PDF ebweru nga iMazing, . Decipher TextMessage, oba SQLite CSV query waggulu ekuba byombi erinnya ly'okulaga NE raw handle.id ennamba y’essimu ku buli bubble bw’obubaka obumu), kakasa nti ennamba y’essimu entuufu eya digito 10 oba email ya Apple ID ey’oyo asindika erabika waggulu ku thread, so si linnya lyokka ery’okukwatagana eriyinza okulongoosebwa.
3. Sika Ebiwandiiko byo Ebitongole Ebikwata ku Masimu (CDRs) & SMS/MMS Timestamp Logs nga Independent Third-Party Coroboration:
4. Wadde ng’omukutu gwo ogw’oku ssimu (AT&T, Verizon, T-Mobile, EE, Vodafone, Rogers, Telstra) tekuuma biwandiiko mu bubaka bwa SMS okumala ebbanga ddene (era telabako birimu bya iMessage/WhatsApp ebikuumibwa), sitatimenti yo ey’omutambuze eya buli mwezi oba omukutu gwa akawunti yo ku yintaneeti guwa ekiwandiiko ky’omuntu ow’okusatu ekyetongodde eky’Olunaku lwennyini, Eddakiika, Obulagirizi (Okuyingira/Okufuluma), n’Essimu Ennamba ya buli bubaka bwa SMS/MMS n'okukuba eddoboozi.
5. Okugattako AT&T / Verizon / T-Mobile Usage Log yo entongole emabega ddala w’ekiwandiiko kyo eky’obubaka ku ssimu kikakasa nti ddala ennamba y’essimu y’oludda olulala yaweereza obubaka ku ssimu yo ku... 14:22:09 on October 12, okusaanyaawo okugamba kwonna nti wajingirira screenshot.
6. Fuwa ebweru Omukutu GW'Emboozi YONNA Ogutalongooseddwa (Etteeka ly'Obujjuvu - Etteeka lya FRE 106):
7. Tolondako bifaananyi bya screenshots ebyetongodde oba crop out your own replies. Mu Federal Rule of Evidence 106, singa owaayo ekitundu ku mboozi ekwatiddwa, oludda oluvuganya lusobola okusaba thread yonna eyeetoolodde, era abalamuzi tebeesiga bifaananyi ebisaliddwako ebisuula timestamps oba obubaka obw’emabega. Kuba entambula y’emboozi mu bujjuvu mu nsengeka y’ebiseera.
8. Kuuma Ekyuma Ekisookerwako NE Fayiro ya SHA-256 Hashed Backup (Etteeka ly'obujulizi erisinga obulungi - Etteeka lya FRE 1002 & Okwekakasa - Etteeka lya FRE 902(14)):
9. Leeta essimu entuufu (ebadde evunaanibwa era nga esumuluddwa) ku mmeeza y'okuwulira emisango mu kkooti olwo singa munnamateeka avuganya asoomooza ekiwandiiko ekikubiddwa, osobole okugamba omulamuzi nti: "Ow'ekitiibwa, nnina ekyuma ekyasooka wano wennyini ku mmeeza ya looya Kkooti okwekebejjebwa okusinziira ku tteeka ly'obujulizi obusinga obulungi."
10. Okugatta ku ekyo, wansi wa Federal Rule of Evidence 902(14) (n’enkanankana n’amasaza agayisiddwa okwetoloola US), data ekoppebwa okuva mu kyuma eky’ebyuma yekakasa bwe ewerekerwako satifikeeti mu buwandiike eraga SHA-256 digital hash value ey’okuggyibwamu okwasooka ne kkopi.
11. Teekako "Ekirango ekikakasa Obubaka bw'Ebiwandiiko/Obw'okunyumya" (Ekipande ky'Okukoppa-n'okuteeka wansi):

DECLARATION AUTHENTICATING ELECTRONIC MESSAGE EVIDENCE
(Pursuant to Federal Rules of Evidence 901(b)(1), 901(b)(4), and 902(14) / State Equivalents)

I, [YOUR FULL LEGAL NAME], declare under penalty of perjury under the laws of the State of [STATE] and the United States of America that the following is true and correct:

1. I am the [Plaintiff / Defendant / Petitioner / Respondent] in this action and have personal knowledge of the facts set forth herein.
2. I am the sole owner and user of the [Apple iPhone / Android Smartphone], assigned telephone number [YOUR 10-DIGIT PHONE NUMBER].
3. Attached hereto as EXHIBIT A is a true, complete, and unedited chronological transcript and printout of [SMS / iMessage / WhatsApp / Signal] messages exchanged between my telephone number ([YOUR NUMBER]) and [NAME OF OTHER PARTY] at telephone number [OTHER PARTY'S 10-DIGIT PHONE NUMBER] between [START DATE] and [END DATE].
4. I personally know that telephone number [OTHER PARTY'S NUMBER] belongs to and is used by [NAME OF OTHER PARTY] because: (a) we have communicated at that number regularly since [YEAR]; (b) I have spoken to [NAME OF OTHER PARTY] by voice call at that exact number and recognized their voice; and (c) the messages inside Exhibit A contain distinctive personal facts, photographs, and references known uniquely to [NAME OF OTHER PARTY] (pursuant to FRE Rule 901(b)(4) Distinctive Characteristics).
5. Not a single message, timestamp, or attachment in Exhibit A has been altered, deleted, or modified in any way. On [DATE OF EXTRACTION], a complete forensic backup of the original messaging database (`[FILENAME, e.g., sms.db / msgstore.db]`) was preserved prior to printing Exhibit A, yielding the following cryptographic SHA-256 hash fingerprint:
   SHA-256 Hash: [INSERT 64-CHARACTER HEXADECIMAL SHA-256 HASH FROM sha256sum / Get-FileHash]
6. Attached hereto as EXHIBIT B are true and correct copies of my official mobile carrier call/message detail records from [NAME OF CARRIER] independently corroborating the dates, times, and telephone numbers of the communications.
7. The original smartphone device and the SHA-256 verified backup archive remain in my secure custody and are available for immediate inspection by the Court.

Executed on [DATE] at [CITY, STATE].

____________________________________
[YOUR SIGNATURE]
[YOUR PRINTED NAME]

Ebibuuzo ebitera okubuuzibwa¶

Ensonda zeekebeddwa¶

• National Institute of Standards and Technology (NIST, Amerika): NIST Special Publication 800-101 Rev. 1: Endagiriro ku byuma ebikozesebwa ku ssimu (Okukuuma, Okwawula RF mu ngeri y’ennyonyi, SQLite Database Artifacts, n’okukakasa Hash).
• Ofiisi y’okuddukanya emirimu mu kkooti za Amerika: Amateeka ga Federo agakwata ku bujulizi (FRE) Etteeka 106 (Ebisigadde oba Ebiwandiiko Ebikwatagana oba Ebiwandiiko), Etteeka 901(b)(1), (b)(4), ne (b)(9) (Okukakasa Obujulizi obw’Ebyuma), Etteeka 902(13) ne 902(14) (Ebiwandiiko Ebikakasibwa Ebikoppoloddwa okuva mu Ekyuma eky’Ebyuma nga kiyita mu Hash Value), n’Etteeka 1002 (Ekyetaagisa kya Original).
• SQLite Consortium: Ebiwandiiko ebitongole ebya SQLite ku Write-Ahead Logging (WAL Mode), Enkola ya Fayiro ya Databases Embi, Emiko egy'Olukalala olw'Obwerufu, n'... .recover Ekiragiro kya CLI.
• Apple Inc.: Apple Platform Security Guide (Ebibiina by'okukuuma data, Nga tonnasooka kusumulula vs Oluvannyuma lw'okusooka okusumulula Key Hierarchy, ne iTunes/Finder Backup Manifest Structure).
• Ekibiina kya ssaayansi ekikola ku bujulizi bwa digito (SWGDE): Enkola Ennungi mu Forensics y’amasimu n’okukebera SQLite Database.

Ebiragiro ebikwatagana nabyo¶

• Essimu emenyese oba eyonoonese amazzi: okutaasa data mu bwangu
• Okusazaamu fayiro mu butanwa, drive formatted, n'okuzzaawo ebifaananyi
• Okuzzaawo fayiro ya Word, Excel, PDF, oba database eyonoonese
• Okuyita okuwa obujulizi, okuyitibwa okwewozaako, n’okuwandiisa ennaku z’omwezi ezisembayo
• Ebiragiro ebiziyiza, ebiragiro ebikuuma, n’ebiragiro eby’amangu
• Ennamba z’ensi yonna ez’amangu