Famerenana hafatra porofo avy amin'ny finday simba na backup chat simba¶

When a critical civil lawsuit, family court custody battle, restraining order hearing, workplace harassment complaint, contractor fraud dispute, or criminal defense hinges on text messages, WhatsApp chats, iMessages, or Signal threads trapped inside a broken phone or a corrupted backup file, a single wrong click can permanently destroy your legal proof. Modern messaging databases do not store messages as simple text files; they store them inside relational SQLite databases (sms.db on iOS, mmssms.db / bugle_db on Android, msgstore.db.crypt14 / crypt15 on WhatsApp, and SQLCipher databases on Signal) accompanied by temporary Write-Ahead Log (.db-wal) journal files.

If you accidentally let a new phone overwrite your single cloud backup with an empty database, or if you open a damaged SQLite database without copying its hidden -wal file first, or if you submit cropped, unauthenticated screenshots that the opposing lawyer objects to as fake, you can lose both the data and the court case.

This guide provides step-by-step non-destructive chat extraction, SQLite database repair, cryptographic backup restoration, and court-admissible forensic preservation protocols based on National Institute of Standards and Technology (NIST) Special Publication 800-101 Rev. 1 (Guidelines on Mobile Device Forensics), Federal Rules of Evidence (FRE) Rules 901(b)(9) and 902(14) (Self-Authenticating Electronic Evidence via SHA-256 Hash Certification), and official SQLite / SQLCipher recovery specifications.

Ataovy izao izao¶

If you need to rescue critical text or chat messages from a damaged phone, an accidentally deleted thread, or a failing backup:

1. Put the phone in Airplane Mode immediately and turn OFF automatic iCloud / Google Drive Backup. This is the #1 rule of mobile forensics. Why? First, when you delete a message in iMessage (sms.db), WhatsApp (msgstore.db), or Android Messages, the text is not immediately erased from the flash drive, it sits inside the SQLite database's "Freelist / Unallocated Pages" or inside the temporary Write-Ahead Log (.db-wal) until the database runs a background VACUUM cleanup or commits new messages over top of it. Second, if a message was deleted on your phone today, your last night's 02:00 AM iCloud Backup or Google Drive WhatsApp Backup still contains the intact message, until tonight's automatic Wi-Fi backup overwrites it. Turning on Airplane Mode stops both local SQLite overwriting and cloud backup overwriting instantly. If you are in immediate physical danger from a domestic abuser or stalker whose messages you are preserving, get to safety first and call your local emergency number (911 in the United States and Canada, 112 across the European Union, 999 in the United Kingdom) or check laharana vonjy maika.
2. Never install or sign into WhatsApp or Signal on a new phone and click "Back Up Now" before restoring your old archive. Millions of users lose years of WhatsApp evidence when setting up a replacement phone: if you skip the initial restore prompt (or if the restore fails at 99 percent) and the new empty WhatsApp installation runs an automatic backup to Google Drive or iCloud, it overwrites your multi-gigabyte historical cloud backup with a 0-kilobyte blank backup.
3. Raha mainty na potipotika ny ecran'ny telefaona (tapaka ny digitizer touche) nefa mbola mivibra na maneno ny telefaonina dia aza averina averina indray. Amin'ny iOS sy Android (File-Based Encryption / Before First Unlock - BFU vs After First Unlock - AFU), raha mbola tsy voahidy indray mandeha ny telefaonina hatramin'ny nisiany farany (AFU fanjakana), ny lakilen'ny kriptografika miaro ny angon-drakitrao hafatra dia mipetraka voadio ao amin'ny RAM, ahafahanao mampifandray amin'ny $15 USB-C / Lightning hub miaraka amin'ny totozy solosaina USB misy tariby sy monitor HDMI hikitika. "Trust This Computer" ary misintona backup eo an-toerana feno. Raha manery anao hamerina indray ny telefaona misy efijery tapaka dia latsaka ao BFU toerana mihidy izay tsy misy totozy USB na solosaina afaka mamoha azy raha tsy manamboatra ny efijery aloha (jereo ny torolàlana momba ny broken or water-damaged phone recovery).
4. Whenever copying a raw SQLite database (sms.db na msgstore.db), ALWAYS copy the three sibling files together (.db, .db-wal, ary .db-shm). Every modern mobile messaging database runs in SQLite WAL (Write-Ahead Logging) mode. Your most recent days or weeks of messages are often sitting inside the companion sms.db-wal na msgstore.db-wal file, NOT inside the main .db file yet. If you copy only sms.db and leave sms.db-wal behind, the most recent messages vanish or the database opens as corrupted.
5. Compute and record a cryptographic SHA-256 hash of any exported backup or database file immediately. Before examining or converting any recovered backup file, run sha256sum (Linux/macOS) or Get-FileHash -Algorithm SHA256 (Windows PowerShell) on the original archive and save the 64-character hash string. Under Federal Rule of Evidence 902(14), a SHA-256 hash value is the gold standard for proving in court that your digital message archive was never altered or photoshopped.

flowchart TD
    A["Urgent Need to Recover & Preserve Evidence Messages (SMS, iMessage, WhatsApp, Signal)"] --> B["IMMEDIATE FREEZE: Enable Airplane Mode on phone & disable auto-cloud backup on other devices"]
    B --> C{"What is the current state of the phone and messages?"}
    C -->|"1. Phone works, but messages were just accidentally deleted"| D["Check if Cloud Backup (iCloud / Google Drive) or Local WhatsApp '/Databases' folder has pre-deletion snapshot"]
    D --> E["Before restoring over live phone: First take a Full Local Encrypted Backup to PC/Mac (`idevicebackup2` / iTunes / Finder / ADB) to preserve SQLite WAL freelists"]
    C -->|"2. Phone screen is broken / black, but board still powers on"| F["Do NOT reboot (Keep in 'After First Unlock' state); connect USB-C/Lightning Hub + Wired USB Mouse + HDMI Display to unlock & authorize PC backup"]
    C -->|"3. Chat Backup file or SQLite database (`sms.db`, `msgstore.db`, Signal) is corrupted / fails to restore"| G["Copy ALL THREE files (`.db`, `.db-wal`, `.db-shm`) into a working directory on PC/Mac"]
    G --> H{"Is the database encrypted (`crypt14/crypt15` or SQLCipher) or standard SQLite?"}
    H -->|"Encrypted WhatsApp / Signal"| I["Decrypt using 64-char E2EE Key / `/data/data/com.whatsapp/files/key` (`wa-crypt-tools`) or Signal 30-digit passphrase (`signalbackup-tools`)"]
    H -->|"Decrypted / Standard SQLite"| J["Amboary ny pejy B-tree simba amin'ny alàlan'ny `sqlite3 .recover` na sokitra ireo rakitra voafafa avy amin'ny frame Freelist & WAL"]
    E --> K["Manamarina ho an'ny Fitsarana: Mamorona SHA-256 Hash + Full-Thread PDF miaraka amin'ny CDRs Carrier + FRE 902(14) fanambarana"]
    I --> K
    J --> K

Architecture amin'ny fitahirizana hafatra amin'ny finday: Aiza no misy ny hafatrao¶

Mba hamerenana ireo hafatra voafafa na simba nefa tsy manimba azy ireo, dia tsy maintsy takatrao hoe aiza no itehirizan'ny rafitra fiasana tsirairay sy ny sehatra fandefasana hafatra ny angon-drakitra mivantana, ny fanalahidin'ny fanafenana azy ary ny backups eo an-toerana.

Scenario 1: Famerenana ireo hafatra iPhone voafafa na simba (sms.db & ChatStorage.sqlite)¶

If critical iMessages, SMS texts, or WhatsApp messages were deleted on an iPhone, or if the iPhone is damaged, follow these exact steps in priority order:

Dingana 1: Jereo ny naorina-in iOS "vaovao vao haingana" vault (voalohany 30 hatramin'ny 40 andro)¶

Amin'ny iOS 16, iOS 17, iOS 18, ary vao haingana, ny famafana lahatsoratra na kofehy iMessage dia ** tsy ** mamindra azy avy hatrany any amin'ny habaka malalaka SQLite manta; mamindra azy ao anaty lahatahiry fako miafina mandritra ny 30 andro (hatramin'ny 40 andro alohan'ny fanadiovana maharitra): 1. Sokafy ny fampiharana Messages amin'ny iPhone. 2. Tsindrio Edit (na Sivana) eo amin'ny zoro ambony havia. 3. Tsindrio Asehoy vao voafafa. 4. Safidio ny resaka ary kitiho ny sitrana.

Dingana 2: Extract sms.db ary ChatStorage.sqlite avy amin'ny Mac / Windows Backup eo an-toerana nefa tsy manisa na inona na inona¶

Raha voafafa tanteraka tao amin'ny "Vaovao vao haingana" ilay hafatra (na raha mila maka hafatra ho an'ny fitsarana ianao na misokitra andalana SQLite voafafa), mamorona backup eo an-toerana feno amin'ny solosaina avy hatrany raha mbola ao anaty fiaramanidina ny telefaona:

1. ** Mampifandray ny iPhone amin'ny alalan'ny tariby USB amin'ny Mac (Finder) na Windows PC (Apple Devices / iTunes) na Linux (libimobiledevice):**
2. Jereo ny boaty ho an'ny "Encrypt local backup" ary mametraha tenimiafina tsotra tsy hohadinoinao (toy ny Evidence1234). (Nahoana no ahafahana manao encryption backup? Ny backup iOS eo an-toerana misy encryption dia ahitana artifacts forensika fanampiny, angon-drakitra momba ny fahasalamana, tantaran'ny fiantsoana, ary ireo entana misy keychain izay nesorin'i Apple tamin'ny backups tsy voafehy).
3. Kitiho ny Back Up Now ary miandry ny hahavitana azy.
4. Tadiavo ny lahatahiry backup manta ao amin'ny solosainao:
5. macOS: -/Library/Application Support/MobileSync/Backup/<UDID>/
6. Windows: %APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\ na %USERPROFILE%\Apple\MobileSync\Backup\<UDID>\
7. ** Adikao manontolo izany <UDID> lahatahiry mankany amin'ny Drive External mitokana avy hatrany ary kajio ny hash SHA-256** mba tsy ho azo ovaina mihitsy ny sary forensika tany am-boalohany.
8. ** Tadiavo ny angona hafatra marina ao anatin'ny iOS Backup amin'ny alàlan'ny Apple SHA-1 Domain Hashes:**
9. Apple dia manova anarana ny rakitra rehetra ao anaty backup iOS amin'ny ** SHA-1 hash azy Domain-RelativePath**, sokajiana ho subdirectories misy tarehin-tsoratra roa:
   • ** Apple SMS / iMessage Database (HomeDomain-Library/SMS/sms.db):** Ao amin'ny subfolder 3d/ -> rakitra 3d0d7e5fb2ce288813306e4d4636395e047a3d28
   • ** WhatsApp iOS Database (AppDomainGroup-group.net.whatsapp.WhatsApp.shared-ChatStorage.sqlite):** Ao amin'ny subfolder 7c/ -> rakitra 7c7fba66680ef796b916b067077cc246adacf01d
   • ** Fanondroana rakitra backup (Manifest.db):** Fanondroana SQLite master mametaka ny sary tsirairay, ny memo feo ary ny hash attaché amin'ny anaran-drakitra tena izy SMS/Attachments/.
10. (Raha navelanao ny fanafenana backup, dia esory ny dika mitovy miasa amin'ny backup ao anaty lahatahiry azo vakina amin'ny alàlan'ny fitaovana misokatra toy ny iphone-backup-decrypt amin'ny Python na mpijery malaza eo an-toerana toa azy iMazing na iBackup Viewer)

Scenario 2: Famerenana ny WhatsApp Android .crypt14 / .crypt15 ary Signal .backup tahiry¶

1. Fanavotana ny WhatsApp backup taloha alohan'ny hifaranan'ny fikandrana mihodina 7 andro¶

Ahoana raha misy olona mamafa resaka WhatsApp manameloka amin'ny findainao Android 3 andro lasa izay, ary ny Google Drive tamin'ny 02:00 maraina tamin'ny alina dia efa nisolo ny dika rahona? - Ampidiro amin'ny solosaina amin'ny alàlan'ny USB ny findainao Android (amin'ny mode File Transfer / MTP) na sokafy ny fampiharana Android Files ary mandehana mankany amin'ny:

Internal Storage/Android/media/com.whatsapp/WhatsApp/Databases/

2. Decrypting corrupted .crypt14 / .crypt15 WhatsApp backups on a computer (wa-crypt-tools)¶

Ahoana raha mianjera amin'ny 95 isan-jato ny rakitra backup WhatsApp mandritra ny famerenana amin'ny laoniny ny telefaona satria simba kely ny angon-drakitra SQLite ao anatin'ilay fonosana voafono? Azonao atao ny mamadika ny .crypt14 na .crypt15 container mivantana amin'ny solosainao, amboary ny angona SQLite, ary vakio ny hafatra rehetra: - ** Raha manana a .crypt15 Backup Encrypted End-to-End** ary nitahiry ny fanalahidinao hexadecimal 64 isa (na raha nesorinao /data/data/com.whatsapp/files/key na encrypted_backup.key), apetraho ny fitaovana forensika Python open source wa-crypt-tools (wagolek):

# Install wa-crypt-tools on Linux, macOS, or Windows Python:
python3 -m pip install wa-crypt-tools

# Decrypt a WhatsApp .crypt15 backup using your 64-character hex key:
wadecrypt <your_64_character_hex_key> msgstore.db.crypt15 msgstore.db

# Or decrypt a .crypt14 backup using the extracted 158-byte key file:
wadecrypt key msgstore.db.crypt14 msgstore.db

3. Fanalana sy fanamboarana Signal simba .backup na angon-drakitra Desktop Signal¶

• ** Ho an'ny Android signal-YYYY-MM-DD.backup fisie:** Raha mandà tsy hanafatra rakitra backup Signal lehibe ny telefaona vaovao (na raha tapaka ilay rakitra rehefa mandika karatra SD efa maty), ampiasao ny fitaovana forensika open source signalbackup-tools(github.com/bepaald/signalbackup-tools) miaraka amin'ny ** fehezan-teny backup numeric 30 isa** mba hamahana ireo sary tsy simba, hanondrana ny angon-drakitra SQLite manta, ary hamorona arisivan'ny resaka HTML madio sy azo karohina miaraka amin'ny fametahana media rehetra tsy misy dikany:

  # Unpack a Signal Android backup (including truncated/partially corrupted archives) to HTML:
  signalbackup-tools signal-2026-10-30.backup "12345 67890 12345 67890 12345 67890" --exporthtml ./recovered_signal_chats/
  

• Ho an'ny Desktop Signal (-/.config/Signal/sql/db.sqlite): Na dia potipotika tamin'ny fianjeran'ny fiara na natsipy tany anaty farihy aza ny findainao ary tsy manana backup an-telefaona ianao, raha toa ka nisy Signal Desktop mifandray ny solosainao, dia adikao ny lahatahiry fampiharana Signal manontolo (%APPDATA%\Signal amin'ny Windows, -/Library/Application Support/Signal amin'ny macOS, na -/.config/Signal amin'ny Linux) alohan'ny hanokafana ny fampiharana, ary manondrana ny angona SQLCipher mampiasa signalbackup-tools na sqlcipher.

Scenario 3: Manamboatra angon-drakitra chat SQLite simba (database disk image is malformed) ary sokitra andalana voafafa¶

Rehefa very ny herin'ny bateria ny telefaona iray dia midira na misy hadisoana fitahirizana tselatra, sokafy sms.db, ChatStorage.sqlite, na msgstore.db manipy ny fahadisoana SQLite mahafaty: Error: database disk image is malformed (SQLITE_CORRUPT)

Aza manao shareware "karama SQLite fixer" an'ny antoko fahatelo manimba ao amin'ny angon-drakitrao voalohany. Ampiasao ny SQLite ofisialy .recover command naorina mivantana ao sqlite3 (dikan-teny 3.29.0+), izay mijery tsirairay ny pejin'ny angon-drakitra manta 4-kilobyte mandingana ireo tondro fanondroana hazo B tapaka:

SQLite tsikelikely .recover ary fanamboarana toby fisavana WAL¶

1. ** Manaova dika mitovy miasa amin'ireo rakitra telo ireo (.db, .db-wal, .db-shm) ao anaty lahatahiry vaovao:**

   mkdir ~/chat_rescue && cp sms.db* ~/chat_rescue/ && cd ~/chat_rescue/
   

2. ** Mandehana ny SQLite ofisialy .recover baiko hananganana angon-drakitra madio (ary hisambotra andalana very/freelist):**

   # Standard recovery of all intact tables and rows into a brand-new healthy database:
   sqlite3 sms.db ".recover" | sqlite3 sms_repaired.db
   
   # FORENSIC DELETED-ROW RECOVERY: Add the --ignore-freelist flag so SQLite ALSO recovers
   # deleted message fragments still sitting inside unallocated freelist pages into a 'lost_and_found' table:
   sqlite3 sms.db ".recover --ignore-freelist" | sqlite3 sms_forensic_with_deleted.db
   

3. ** Manondrana transcript CSV/HTML azo vakiana, araka ny fotoana, avy amin'ny angon-drakitra namboarina:**
4. ** Ho an'ny Apple iOS sms.db (Nanova ny Timetamp Nanosecond CoreData an'ny Apple nanomboka tamin'ny 1 Jan 2001 ho UTC/Daty eo an-toerana):**

   sqlite3 -header -csv sms_repaired.db "
   SELECT
       m.ROWID AS MsgID,
       datetime(m.date / 1000000000 + 978307200, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.is_from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       h.id AS Contact_Phone_Or_Email,
       m.service AS Service_Type,
       m.text AS Message_Body,
       a.filename AS Attachment_Path
   FROM message m
   LEFT JOIN handle h ON m.handle_id = h.ROWID
   LEFT JOIN message_attachment_join maj ON m.ROWID = maj.message_id
   LEFT JOIN attachment a ON maj.attachment_id = a.ROWID
   ORDER BY m.date ASC;
   " > recovered_imessage_transcript.csv
   

5. ** Ho an'ny WhatsApp Android msgstore.db (Maoderina message tabilao schema):**

   sqlite3 -header -csv msgstore_repaired.db "
   SELECT
       m._id AS MsgID,
       datetime(m.timestamp / 1000, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       jid.raw_string AS Chat_Or_Sender_JID,
       m.text_data AS Message_Body
   FROM message m
   LEFT JOIN chat c ON m.chat_row_id = c._id
   LEFT JOIN jid ON c.jid_row_id = jid._id
   ORDER BY m.timestamp ASC;
   " > recovered_whatsapp_transcript.csv
   

Ataovy azo ekena 100% eny amin'ny fitsarana ny hafatrao sitrana (Miala amin'ny fanoherana "Fake Screenshot")¶

Isan-kerinandro ao amin'ny fitsarana fianakaviana, fitsarana fitakiana kely, fitsarana didy mifehy, ary fitsarana sivily, manatona ny mpitsara ny olona miaraka amin'ny pikantsarin'ny finday avo lenta izay misy ny lohatenin'ny mpifandray fotsiny milaza anaram-bosotra toy ny "Ex-Husband" na "Landlord Mike" tsy misy laharana finday ary tsy misy daty feno. Manohitra avy hatrany ny mpisolovava mpanohitra eo ambanin'ny Fitsipika Federaly momba ny porofo 901 (Tsy fahampian'ny fanamarinana) sy Fitsipika faha-106 (Fitsipika momba ny fahafenoana), izay milaza fa misy afaka manova anarana finday faharoa voaloa mialoha. "Landlord Mike" ao amin'ny app contacts ary mandefa hafatra sandoka ho azy ireo ao anatin'ny 30 segondra.

Ny lisitry ny fanamarinana fanamarinana ny efitrano fitsarana 5 ho an'ny porofo amin'ny lahatsoratra & amin'ny chat¶

1. Esory vetivety na ovay anarana ny anaram-bositra ny mpifandray alohan'ny hanondranana/fanitsiana sary ka ny laharana finday (+1-555-019-2834) na mailaka miseho amin'ny lohapejy rehetra:
2. Alohan'ny maka pikantsary backup (na tsara kokoa, ampiasao fitaovana fanondranana PDF feno toy ny iMazing, Decipher TextMessage, na ny fangatahana CSV SQLite etsy ambony izay manonta ny anarana aseho SY ny manta handle.id phone number on every single message bubble), make sure the actual 10-digit telephone number or Apple ID email of the sender is visible at the top of the thread, not just a customizable contact nickname.
3. Pull Your Official Mobile Carrier Call Detail Records (CDRs) & SMS/MMS Timestamp Logs as Independent Third-Party Corroboration:
4. While your mobile carrier (AT&T, Verizon, T-Mobile, EE, Vodafone, Rogers, Telstra) does not keep the text content of SMS messages for long (and never sees encrypted iMessage/WhatsApp content), your monthly carrier statement or online account portal provides an independent third-party log of the exact Date, Minute, Direction (Incoming/Outgoing), and Phone Number of every SMS/MMS message and voice call.
5. Attaching your official AT&T / Verizon / T-Mobile Usage Log right behind your text message printout proves that the other party's phone number actually transmitted an SMS to your phone at 14:22:09 on October 12, destroying any claim that you faked the screenshot.
6. Export the ENTIRE Unedited Conversation Thread (Rule of Completeness - FRE Rule 106):
7. Never cherry-pick isolated screenshots or crop out your own replies. Under Federal Rule of Evidence 106, if you offer part of a recorded conversation, the opposing party can demand the entire surrounding thread, and judges distrust cropped images that omit timestamps or prior messages. Print the complete chronological conversation flow.
8. Preserve the Original Device AND the SHA-256 Hashed Backup File (Best Evidence Rule - FRE Rule 1002 & Self-Authentication - FRE Rule 902(14)):
9. Bring the actual physical phone (charged and unlocked) with you to the courtroom hearing table so that if the opposing lawyer challenges the printout, you can tell the judge: "Your Honor, I have the original device right here at counsel table for the Court's inspection pursuant to the Best Evidence Rule."
10. In addition, under Federal Rule of Evidence 902(14) (and state equivalents adopted across the US), data copied from an electronic device is self-authenticating when accompanied by a written certification setting forth the SHA-256 digital hash value of the original extraction and the copy.
11. Attach a Signed "Declaration Authenticating Electronic Text/Chat Messages" (Copy-and-paste template below):

DECLARATION AUTHENTICATING ELECTRONIC MESSAGE EVIDENCE
(Pursuant to Federal Rules of Evidence 901(b)(1), 901(b)(4), and 902(14) / State Equivalents)

I, [YOUR FULL LEGAL NAME], declare under penalty of perjury under the laws of the State of [STATE] and the United States of America that the following is true and correct:

1. I am the [Plaintiff / Defendant / Petitioner / Respondent] in this action and have personal knowledge of the facts set forth herein.
2. I am the sole owner and user of the [Apple iPhone / Android Smartphone], assigned telephone number [YOUR 10-DIGIT PHONE NUMBER].
3. Attached hereto as EXHIBIT A is a true, complete, and unedited chronological transcript and printout of [SMS / iMessage / WhatsApp / Signal] messages exchanged between my telephone number ([YOUR NUMBER]) and [NAME OF OTHER PARTY] at telephone number [OTHER PARTY'S 10-DIGIT PHONE NUMBER] between [START DATE] and [END DATE].
4. I personally know that telephone number [OTHER PARTY'S NUMBER] belongs to and is used by [NAME OF OTHER PARTY] because: (a) we have communicated at that number regularly since [YEAR]; (b) I have spoken to [NAME OF OTHER PARTY] by voice call at that exact number and recognized their voice; and (c) the messages inside Exhibit A contain distinctive personal facts, photographs, and references known uniquely to [NAME OF OTHER PARTY] (pursuant to FRE Rule 901(b)(4) Distinctive Characteristics).
5. Not a single message, timestamp, or attachment in Exhibit A has been altered, deleted, or modified in any way. On [DATE OF EXTRACTION], a complete forensic backup of the original messaging database (`[FILENAME, e.g., sms.db / msgstore.db]`) was preserved prior to printing Exhibit A, yielding the following cryptographic SHA-256 hash fingerprint:
   SHA-256 Hash: [INSERT 64-CHARACTER HEXADECIMAL SHA-256 HASH FROM sha256sum / Get-FileHash]
6. Attached hereto as EXHIBIT B are true and correct copies of my official mobile carrier call/message detail records from [NAME OF CARRIER] independently corroborating the dates, times, and telephone numbers of the communications.
7. The original smartphone device and the SHA-256 verified backup archive remain in my secure custody and are available for immediate inspection by the Court.

Executed on [DATE] at [CITY, STATE].

____________________________________
[YOUR SIGNATURE]
[YOUR PRINTED NAME]

Fanontaniana apetraka matetika¶

Loharano nojerena¶

• National Institute of Standards and Technology (NIST, United States): NIST Special Publication 800-101 Rev. 1: Guidelines on Mobile Device Forensics (Preservation, Airplane Mode RF Isolation, SQLite Database Artifacts, and Hash Verification).
• Administrative Office of the United States Courts: Federal Rules of Evidence (FRE) Rule 106 (Remainder of or Related Writings or Recorded Statements), Rule 901(b)(1), (b)(4), and (b)(9) (Authenticating Electronic Evidence), Rule 902(13) and 902(14) (Certified Data Copied from an Electronic Device via Hash Value), and Rule 1002 (Requirement of the Original).
• SQLite Consortium: Official SQLite Documentation on Write-Ahead Logging (WAL Mode), File Format of Corrupt Databases, Freelist Pages, and the .recover CLI Command.
• Apple Inc.: Torolalana fiarovana amin'ny Apple Platform (Kilasy miaro ny angona, alohan'ny hamoha voalohany vs aorian'ny ambaratongan'ny fanalahidy voalohany mamoha, ary ny rafitry ny fanehoana an-tsary iTunes/Finder).
• Vondrona miasa ara-tsiansa momba ny porofo nomerika (SWGDE): Fomba fanao tsara indrindra ho an'ny Forensika finday sy fanadihadiana SQLite Database.

Mpitarika mifandraika¶

• Telefaonina simba na simba ny rano: vonjy maika
• Famafana rakitra tsy nahy, fiara voalamina, ary fanarenana sary
• Teny simba, Excel, PDF, na fanarenana rakitra angona
• Fiantsoana ho vavolombelona, ​​fiantsoana fametrahana, ary fe-potoana famokarana antontan-taratasy
• Didy famerana, baiko fiarovana ary didy vonjy maika
• Laharana vonjy maika maneran-tany