Bilbila miidhame ykn chat backup manca'e irraa ergaa ragaa deebisuu¶

Himannaan siviilii murteessaan, lola eeggumsa mana murtii maatii, dhaddacha ajaja dhorkaa, himannaan rakkina bakka hojii, falmii hanna kontiraaktaraa, ykn ittisa yakkaa ergaa barreeffamaa, chaat WhatsApp, iMessages, ykn Signal threads bilbila cabe ykn faayila duwwaa manca’e keessa qabame irratti yeroo hundaa’u, cuqaasuun dogoggoraa tokko ragaa seeraa keessan dhaabbataadhaan balleessuu danda’a. Kuusaawwan deetaa ergaa ammayyaa ergaawwan akka faayilii barruu salphaatti hin kuusan; isaanis hariiroo SQLite databases (sms.db iOS irratti, . mmssms.db / . bugle_db Android irratti, . msgstore.db.crypt14 / . crypt15 WhatsApp irratti, fi kuusdeetaa SQLCipher Signal irratti) yeroof Write-Ahead Log (.db-wal) faayiloota joornaalii.

Yoo akka tasaa bilbilli haaraan kuusdeetaa duwwaa ta'een kuusdeetaa duumessa tokkicha kee akka irra barreessu hayyamte, ykn kuusdeetaa SQLite miidhame osoo dhokataa isaa hin waraabin bante -wal dursitee galmeessi, ykn suuraawwan iskiriinii murame, kan hin mirkanoofne kan abukaatoon mormituu akka sobaatti mormu yoo galchite, daataa fi dhimma mana murtii lamaanuu dhabuu dandeessa.

Qajeelfamni kun tartiiba tarkaanfiin chat kan hin balleessine baasuu, suphaa kuusdeetaa SQLite, deebisanii dhaabuu duwwaa kirptoogiraafii, fi pirootokoolota kunuunsa fooransikii mana murtiin fudhatama qaban kan maxxansa addaa Inistiitiyuutii Istaandardii fi Teeknooloojii Biyyaalessaa (NIST) 800-101 Rev 902(14) (Ragaa Elektirooniksii Ofiin Mirkaneessuu karaa Mirkaneessa Haashii SHA-256), fi ibsa SQLite / SQLCipher deebisuu ofiisaa.

Amma kana godhi¶

Yoo barreeffama ykn ergaawwan marii murteessoo bilbila miidhame, dhaamsa akka tasaa haqame, ykn duwwaa kufe irraa baraaruu barbaadde:

1. Bilbila hatattamaan Airplane Mode keessa galchuun automatic iCloud / Google Drive Backup OFF gochuu. Kun seera #1 mobile forensics ti. Maalif? Tokkoffaa, yeroo ergaa iMessage (sms.db), WhatsApp (msgstore.db), ykn Ergaawwan Andirooyidii, barreeffamni sun battalumatti flash drive irraa hin haqamu, kuusdeetaa SQLite keessa taa'a "Freelist / Unallocated Pages" ykn yeroof Write-Ahead Log (.db-wal) hanga kuusdeetaan duubbee hojjetutti VACUUM qulqulleessuu ykn ergaa haaraa gubbaa isaa irratti raawwata. Lammaffaa, har'a ergaan bilbila keessan irratti yoo haqame, iCloud Backup ykn Google Drive WhatsApp Backup halkan edaa sa'aatii 02:00 AM irratti gootan ammallee ergaa hin tuqamne sana of keessaa qaba, hanga halkan kanaa automatic Wi-Fi backup irra barreessu. Haala Xiyyaaraa ibsuun SQLite naannoo irra barreessuu fi duumessa duwwaa irra barreessuu battalumatti dhaaba. Yoo nama mana keessaa miidhu ykn nama hordofu kan ergaa isaa eegdu irraa balaa qaamaa hatattamaa si mudate, dursitee bakka nageenyaa dhaqiitii lakkoofsa balaa tasaa naannoo keetii (911 Ameerikaa fi Kanaadaa keessatti, 112 guutuu Gamtaa Awurooppaa, 999 Yunaayitid Kingidam keessatti) bilbili ykn ilaali lakkoofsa balaa tasaa.
2. Bilbila haaraa irratti WhatsApp ykn Signal gonkumaa hin install ykn seenuun "Back Up Now" cuqaasuun dura archive keessan isa durii hin deebisin. Fayyadamtoonni miliyoonaan lakkaa'aman yeroo bilbila bakka bu'u saagdan ragaa WhatsApp waggootaaf dhaban: yoo jalqaba restore prompt darbitan (ykn restore dhibbeentaa 99n yoo kufe) fi WhatsApp install haaraan duwwaa ta'e automatic backup gara Google Drive ykn iCloud, duwwaa duumessa seenaa giigaabaayitii hedduu kee duwwaa duwwaa kiiloobaayitii 0 ta'een irra barreessa.
3. Yoo screen bilbilaa gurraacha ykn caccabee (touch digitizer cabe) garuu bilbilli ammallee vibrate ykn chime ta'e, reboot hin godhinaa. iOS fi Android lamaan irratti (File-Based Encryption / Before First Unlock - BFU vs After First Unlock - AFU), hanga bilbilli sun erga yeroo dhumaaf deebi'ee jalqabe al tokko unlock ta'etti (AFU state), furtuuwwan kirpitoogiraafii kuusdeetaa ergaa keessanii eegan RAM keessatti decrypted taa'anii jiru, kunis $15 USB-C / Lightning hub hantuuta kompiitaraa USB wayyaa qabuu fi HDMI monitor waliin cuqaasuuf isin dandeessisa "Trust This Computer" fi duwwaa naannoo guutuu harkisuu. Bilbila iskiriinii cabee qabu humnaan deebiftee yoo jalqabde gara BFU haala cufame kan hantuutni USBs ta'e kompiitaraan dursee iskiriinii osoo hin sirreessine qulfii hiikuu hin dandeenye (qajeelfama keenya irratti ilaali bilbila cabee ykn bishaaniin miidhame deebisuu).
4. Yeroo hunda kuusdeetaa SQLite raw waraabdu (sms.db ykn msgstore.db), YEROO HUNDA faayiloota obbolaa sadan walitti waraabuu (.db, . .db-wal, fi .db-shm). Kuusdeetaan ergaa moobaayilaa ammayyaa hundi haala SQLite WAL (Write-Ahead Logging) tiin hojjeta. Guyyoota ykn torban hedduun ergaawwan kee yeroo baay’ee hiriyyaa keessa taa’anii jiru sms.db-wal ykn msgstore.db-wal faayilii, ijoo keessaa MITI .db faayila ammallee. Yoo copy qofa goote sms.db jedhee dhiisi sms.db-wal duuba, ergaawwan dhiyoo ni badu ykn kuusdeetaan akka manca'etti banama.
5. Faayila duwwaa ykn kuusdeetaa ergame kamiyyuu hash kirpitoogiraafii shallaguu fi galmeessuu. Faayila duwwaa deebi'e kamiyyuu qorachuu ykn jijjiiruu dura, fiigi sha256sum (Linux/macOS) ykn Get-FileHash -Algorithm SHA256 (Windows PowerShell) kuusaa jalqabaa irratti fi dhangii haashii arfiilee 64 qusadhu. Seera Ragaa Federaalaa 902(14) jalatti, gatii haashiin SHA-256 kuusaan ergaa dijitaalaa keessan gonkumaa jijjiiramee ykn footoshopii godhamee akka hin beekne mana murtiitti mirkaneessuuf ulaagaa warqeeti.

flowchart TD
    A["Ergaa Ragaa (SMS, iMessage, WhatsApp, Signal) Deebisuu fi Kunuunsuun Hatattamaa Barbaachisa"] --> B["IMMEDIATE FREEZE: Bilbila irratti Airplane Mode dandeessisi & meeshaalee biroo irratti auto-cloud backup dhorkuu"]
    B --> C{"Haalli bilbilaa fi ergaawwan yeroo ammaa maal fakkaata?"}
    C -->|"1. Bilbilli ni hojjeta, garuu ergaan akka tasaa qofa haqame"| D["Galmeen Cloud Backup (iCloud / Google Drive) ykn Local WhatsApp '/Databases' suuraa dursee haquu qabaachuu isaa ilaalaa"]
    D --> E["Bilbila kallattiin deebisuu dura: Jalqaba SQLite WAL freelists eeguuf Full Local Encrypted Backup gara PC/Mac (`idevicebackup2` / iTunes / Finder / ADB) fudhadhu"]
    C -->|"2. Iskiriiniin bilbilaa cabee / gurraacha, garuu boordii ammallee humna ibsa"| F["Irra deebitee HIN jalqabiin (Haala 'After First Unlock' keessa eegi); USB-C/Lightning Hub + Wired USB Mouse + HDMI Display walitti hidhuun PC backup banuuf & hayyama"]
    C -->|"3. Chat Faayilli Duwwaa ykn kuusdeetaa SQLite (`sms.db`, ​​`msgstore.db`, ​​Mallattoo) manca'eera / deebisuu hin dandeenye"| G["Faayilota SADII (`.db`, ​​`.db-wal`, `.db-shm`) gara galmee hojii PC/Mac irratti waraabi"]
    G --> H{"Kuusaan deetaa icciitii qaba (`crypt14/crypt15` ykn SQLCipher) moo SQLite istaandaardii?"}
    H -->|"WhatsApp / Signal kan icciitii ta'e"| I["Furtuu E2EE 64-char fayyadamuun hiikuu / `/data/data/com.whatsapp/files/key` (`wa-crypt-tools`) ykn Mallattoo gaalee dabarsoo dijiitii 30 (`signalbackup-tools`)"]
    H -->|"Decrypted / SQLite Istaandardii"| J["Fuula B-muka manca'e `sqlite3 .recover` fayyadamuun suphaa ykn galmeewwan haqaman Freelist & WAL frames irraa bocu"]
    E --> K["Mana Murtiif Mirkaneessuu: Hash-256 Hash + Full-Thread PDF Carrier CDRs + Labsii FRE 902(14) waliin uumuu"]
    I --> K
    J --> K

Arkiteekcharii kuusaa ergaa moobaayilaa: Bakka ergaawwan kee qabatamaan jiraatan¶

Ergaawwan haqaman ykn manca'an osoo hin balleessin deebisuuf, tokkoon tokkoon sirna hojii fi waltajjii ergaa eessatti kuusdeetaa isaa jiraataa, furtuuwwan icciitii isaa, fi duwwaawwan naannoo rolling isaa akka kuufatu hubachuu qabda:

Haala 1ffaa: Ergaawwan iPhone haqaman ykn manca’an deebisuu (sms.db & . ChatStorage.sqlite) .¶

Yoo iMessages murteessoo ta'an, barreeffamoonni SMS, ykn ergaawwan WhatsApp iPhone irratti haqaman, ykn yoo iPhone miidhame, tartiiba dursa kennuudhaan tarkaanfiiwwan sirrii kana hordofaa:

Tarkaanfii 1: Kuusaa iOS "Recently Deleted" jedhu keessa jiru ilaali (Guyyoota 30 hanga 40 jalqabaa) .¶

iOS 16, iOS 17, iOS 18, fi haaraa irratti, barruu ykn dhaamsa iMessage haquun hin battalumatti gara iddoo tarree bilisaa SQLite raw tti hin sochoosu; gara galmee kosii dhokataa guyyoota 30f (hanga guyyoota 40 dura qulqulleessuu dhaabbataa dura): 1. Appii Messages jedhu iPhone irratti banaa. 2. Golee gubbaa-bitaa irratti Gulaali (ykn Filters) tuqi. 3. Akka Dhiheenyatti Haqame Agarsiisi tuqi. 4. Haasaa filadhuutii Recover tuqi.

Tarkaanfii 2: Baasuu sms.db fi ChatStorage.sqlite osoo homaa irra hin barreessiin Local Mac / Windows Backup irraa¶

Yoo ergaan sun "Recently Deleted" irraa dhaabbataadhaan haqame (ykn ergaawwan mana murtiif baasuu ykn tarreewwan SQLite haqaman bocuu yoo barbaadde), bilbilli ammallee Haala Xiyyaaraa keessa osoo jiruu battalumatti kompitara irratti duwwaa naannoo guutuu uumi:

1. Iphone karaa USB cable Mac (Finder) ykn Windows PC (Apple Devices / iTunes) ykn Linux (libimobiledevice):
2. Sanduuqa "Encrypt local backup" jedhu mallatteessii jecha icciitii salphaa hin daganne (kan akka Evidence1234). (Maaliif icciitii duwwaa dandeessisi? Duubdeebii iOS naannoo icciitii ta'e meeshaalee fooransikii dabalataa, daataa fayyaa, seenaa bilbilaa, fi wantoota furtuu Applen duwwaa icciitii hin taane keessaa baasu of keessatti qabata).
3. Back Up Now cuqaasuun akka xumuramu eegaa.
4. Galmee raw backup kompitara keessan irratti barbaadaa:
5. macOS: -/Library/Application Support/MobileSync/Backup/<UDID>/
6. Foddaawwan: %APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\ ykn %USERPROFILE%\Apple\MobileSync\Backup\<UDID>\
7. Guutummaa sana koppii godhaa <UDID> galmee gara Diraayiva Alaa adda ta'etti hatattamaan gara Hash SHA-256 isaa shallagi kanaaf suuraan fooransikii jalqabaa kee gonkumaa jijjiiramuu hin danda'u.
8. Kuusdeetaa ergaa sirrii iOS Backup keessaa SHA-1 Domain Hashes Apple fayyadamuun barbaadi:
9. Applen faayila iOS backup keessa jiru hunda gara SHA-1 hash of its Domain-RelativePath, galmeewwan xiqqaa arfii lamaatti saagame:
   • Kuusaa Ergaa gabaabaa Apple / iMessage (HomeDomain-Library/SMS/sms.db): Galmee xiqqaa irratti argama 3d/ -> faayilii ** .3d0d7e5fb2ce288813306e4d4636395e047a3d28** **
   • Kuusaa Deetaa iOS WhatsApp (AppDomainGroup-group.net.whatsapp.WhatsApp.shared-ChatStorage.sqlite): Galmee xiqqaa irratti argama 7c/ -> faayilii ** .7c7fba66680ef796b916b067077cc246adacf01d** **
   • Indeeksii Faayilii Duubdeebii (Manifest.db): Indeeksii SQLite master suuraa tokko tokko, yaadannoo sagalee, fi haashii dabalataa hunda gara maqaa faayilii isaa isa dhugaatti kaartaa godhu SMS/Attachments/.
10. (Yoo icciitii duwwaa dandeessifte, waraabbii hojii duwwaa gara galmee dubbifamuu danda'utti meeshaalee madda banaa kan akka iphone-backup-decrypt in Python ykn daawwattoota naannoo beekamoo akka iMazing ykn iBackup Viewer).

Seenaa 2ffaa: WhatsApp Android deebifachuu .crypt14 / . .crypt15 fi Mallattoo .backup galmeewwan kuusaa¶

1. Osoo rolling window guyyaa 7 hin xumuramin dura WhatsApp backup durii baraaruu¶

Namni tokko guyyaa 3 dura bilbila Andirooyidii keessan irratti haasawa WhatsApp yakkamaa ta'e yoo haqee, galgala edaa sa'aatii 02:00 AM Google Drive backup duraan cloud copy irra yoo barreesse hoo? - Bilbila Android keessan karaa USB (File Transfer / MTP mode) kompiitara keessa galchaa ykn appii Android Files banachuun gara:

Internal Storage/Android/media/com.whatsapp/WhatsApp/Databases/

2. Decrypting manca'e .crypt14 / . .crypt15 WhatsApp backups kompitara irratti (wa-crypt-tools) .¶

Yoo faayilli duwwaa WhatsApp yeroo bilbilli deebisu dhibbeentaa 95n kufe sababni isaas kuusni deetaa SQLite marfata icciitii keessa jiru xiqqoo waan manca'eef hoo? Decrypt gochuu dandeessu .crypt14 ykn .crypt15 qabduu kallattiin kompiitara kee irratti, kuusdeetaa SQLite suphaa, fi ergaa hunda dubbisi: - Yoo qabaatte a .crypt15 Duubdeebii Icciitii Dhuma-gara-Dhumaatti fi furtuu heksaadesimaalii dijiitii 64** kee (ykn yoo baafte) qusatte /data/data/com.whatsapp/files/key ykn encrypted_backup.key), meeshaa fooransikii Paayitoon madda banaa fe'i ** .wa-crypt-tools (wagolek)**:

# Install wa-crypt-tools on Linux, macOS, or Windows Python:
python3 -m pip install wa-crypt-tools

# Decrypt a WhatsApp .crypt15 backup using your 64-character hex key:
wadecrypt <your_64_character_hex_key> msgstore.db.crypt15 msgstore.db

# Or decrypt a .crypt14 backup using the extracted 158-byte key file:
wadecrypt key msgstore.db.crypt14 msgstore.db

3. Mallattoo manca’e baasuu fi suphuu .backup ykn kuusdeetaa Deeskitooppii Mallattoo¶

• Andirooyidiif signal-YYYY-MM-DD.backup faayiloota: Bilbilli haaraan faayilii duwwaa Mallattoo guddaa galchuu yoo dide (ykn yeroo kaardii SD du'aa jiru irraa waraabdu faayilii yoo cite), meeshaa fooransikii madda banaa fayyadami signalbackup-tools (github.com/bepaald/signalbackup-tools) gaalee dabarsoo duwwaa lakkoofsaa dijiitii 30 kee waliin furmaata hin miidhamne hiikuuf, kuusdeetaa SQLite raw erguuf, fi kuusaa haasawa HTML qulqulluu, barbaadamu kan dabalata miidiyaa hunda osoo hin tuqamne uumuuf:

  # Unpack a Signal Android backup (including truncated/partially corrupted archives) to HTML:
  signalbackup-tools signal-2026-10-30.backup "12345 67890 12345 67890 12345 67890" --exporthtml ./recovered_signal_chats/
  

• Deeskitooppii Mallattoo (-/.config/Signal/sql/db.sqlite): Yoo bilbila ismaartii keessan balaa konkolaataatiin caccabee ykn haroo keessatti darbatamee fi bilbila zeeroo backup qabaattan illee, laptop keessan yoom iyyuu Signal Desktop linked yoo qabaate, galmee application Signal guutuu copy (%APPDATA%\Signal Windows irratti, . -/Library/Application Support/Signal macOS irratti, ykn -/.config/Signal Linux irratti) appicha banuun dura, fi kuusdeetaa SQLCipher fayyadamuun erguu signalbackup-tools ykn sqlcipher.

Haala 3ffaa: Kuusaa deetaa marii SQLite manca'e suphuu (database disk image is malformed) fi tarreewwan haqaman bocuu¶

Yeroo bilbilli tokko humna baatirii mid-write dhabe ykn dogoggora kuusaa flash mudatu, banamuu sms.db, . ChatStorage.sqlite, ykn msgstore.db dogongora SQLite du'aa darbata: Error: database disk image is malformed (SQLITE_CORRUPT)

Gonkumaa kuusdeetaa jalqabaa kee irratti "paid SQLite fixer" shareware qaama sadaffaa diigaa hin hojjetin. SQLite ofiisaa fayyadami .recover ajaja kallattiin keessa ijaarame sqlite3 (version 3.29.0+), kan fuula kuusdeetaa kiiloobaayitii 4 raw tokko tokkoon sakatta'u agarsiistota indeeksii B-muka cabee bira darbuudhaan:

Tarkaanfii tarkaanfiin SQLite .recover fi suphaa buufata sakatta’iinsaa WAL¶

1. Faayilota kuusdeetaa sadan hunda waraabbii hojii hojjechuu (.db, . .db-wal, . .db-shm) galmee haaraa keessatti:

   mkdir ~/chat_rescue && cp sms.db* ~/chat_rescue/ && cd ~/chat_rescue/
   

2. SQLite ofiisaa hojjedhu .recover ajaja kuusdeetaa qulqulluu deebisee ijaaruuf (fi tarreewwan bade/tarree bilisaa qabachuu):

   # Standard recovery of all intact tables and rows into a brand-new healthy database:
   sqlite3 sms.db ".recover" | sqlite3 sms_repaired.db
   
   # FORENSIC DELETED-ROW RECOVERY: Add the --ignore-freelist flag so SQLite ALSO recovers
   # deleted message fragments still sitting inside unallocated freelist pages into a 'lost_and_found' table:
   sqlite3 sms.db ".recover --ignore-freelist" | sqlite3 sms_forensic_with_deleted.db
   

3. Kuusdeetaa suphame irraa tiraanskriiptii CSV/HTML kan namaan dubbifamuu danda'u, tartiiba yerootiin erguu:
4. Apple iOS tiif sms.db (Apple's CoreData Nanosecond Timestamp Jan 1, 2001 irraa eegalee gara UTC/Guyyaa Naannootti jijjiiruu):

   sqlite3 -header -csv sms_repaired.db "
   SELECT
       m.ROWID AS MsgID,
       datetime(m.date / 1000000000 + 978307200, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.is_from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       h.id AS Contact_Phone_Or_Email,
       m.service AS Service_Type,
       m.text AS Message_Body,
       a.filename AS Attachment_Path
   FROM message m
   LEFT JOIN handle h ON m.handle_id = h.ROWID
   LEFT JOIN message_attachment_join maj ON m.ROWID = maj.message_id
   LEFT JOIN attachment a ON maj.attachment_id = a.ROWID
   ORDER BY m.date ASC;
   " > recovered_imessage_transcript.csv
   

5. WhatsApp Andirooyidiif msgstore.db (Ammayyaa message iskiimaa gabatee):

   sqlite3 -header -csv msgstore_repaired.db "
   SELECT
       m._id AS MsgID,
       datetime(m.timestamp / 1000, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       jid.raw_string AS Chat_Or_Sender_JID,
       m.text_data AS Message_Body
   FROM message m
   LEFT JOIN chat c ON m.chat_row_id = c._id
   LEFT JOIN jid ON c.jid_row_id = jid._id
   ORDER BY m.timestamp ASC;
   " > recovered_whatsapp_transcript.csv
   

Ergaawwan keessan deebifaman mana murtiitti 100% fudhatama akka qabaatan gochuu (Moormii "Fake Screenshot" jedhu irraa fagaachuu)¶

Torban torbaniin mana murtii maatii, mana murtii himannaa xixiqqaa, dhaddacha ajaja dhorkaa, fi falmii siviilii keessatti namoonni suuraa iskiriinii bilbila ismaartii laaftuu fi murame bakka mata dureen gubbaa quunnamtii sanaa maqaa maqaa ijoollee qofa jedhu qabatanii gara abbaa murtiitti ol ba'u "Ex-Husband" ykn "Landlord Mike" lakkoofsa bilbilaa fi guyyaa guutuu kan hin qabne. Abukaatoon mormitootaa battalumatti Seera Ragaa Federaalaa 901 (Hanqina Mirkaneessuu) fi Seera 106 (Seera Guutuu) jalatti mormu, namni kamiyyuu bilbila dursee kaffalame lammaffaa maqaa jijjiiruu danda'a jechuun falmu "Landlord Mike" app contacts isaanii keessa galchuun ergaa sobaa sekondii 30 keessatti ofii isaaniif barreessaa.

Tarree Mirkaneessa Mana Murtii Qabxii 5 Ragaa Barruu fi Chaat¶

1. Yeroodhaaf Maqaa Maqaa Quunnamtii sanaa Haquu ykn Maqaa Jijjiiruu Osoo Al-ergii/Screenshotting hin godhin dura kanaaf Lakkoofsi Bilbilaa Raw (+1-555-019-2834) ykn Email Mata Duree Hunda Keessatti Mul'ata:
2. Suuraa iskiriinii duwwaa fudhachuu dura (ykn kana caalaa gaarii ta'e, meeshaa PDF erguu guutuu-thread akka iMazing, . Decipher TextMessage, ykn gaaffii SQLite CSV armaan olii kan maqaa agarsiisaa FI raw lamaan maxxansu handle.id lakkoofsi bilbilaa bubbee ergaa tokko tokko hunda irratti), lakkoofsi bilbilaa dijiitii 10 qabatamaan ykn iimeeliin Apple ID ergichaa maqaa ijoollee quunnamtii dhuunfaatti jijjiiramuu danda'u qofa osoo hin taane gubbaa dhaamsa sanaa irratti akka mul'atu mirkaneessi.
3. Galmeewwan Bal'ina Bilbilaa (CDRs) & Galmee Chaappaa Yeroo SMS/MMS Official Keessan Akka Mirkaneessa Qaama Sadaffaa Walaba Ta'etti Harkisaa:
4. Dhaabbanni moobaayilaa keessan (AT&T, Verizon, T-Mobile, EE, Vodafone, Rogers, Telstra) qabiyyee barreeffamaa ergaawwan ergaa gabaabaa yeroo dheeraaf kan hin turre yoo ta’u (qabiyyee iMessage/WhatsApp icciitii ta’e immoo gonkumaa kan hin argine), ibsi geejjibaa ji’a ji’aan ykn poortaalli herrega toora interneetii keessanii galmee qaama sadaffaa walaba ta’e kan Guyyaa, Daqiiqaa, Kallattii (Galuu/Ba’u), fi Bilbila sirrii ta’e kenna Lakkoofsa ergaa ergaa gabaabaa/MMS fi bilbila sagalee hunda.
5. Maxxansa ergaa barreeffamaa keessanii duuba AT&T / Verizon / T-Mobile Usage Log ofiisaa keessan maxxansuun lakkoofsi bilbilaa qaama biraa dhugumatti ergaa gabaabaa bilbila keessaniif akka dabarsee mirkaneessa 14:22:09 on October 12, suuraa iskiriinii sana fakkeessite jechuun himannaa kamiyyuu balleessuu.
6. Dhaamsa Haasaa Hin Gulaalamne GUUTUU erguu (Seera Guutuu - Seera FRE 106):
7. Gonkumaa suuraa iskiriinii adda baafame cherry-pick ykn deebii mataa keetii hin muratin. Seera Ragaa Federaalaa 106 jalatti, yoo kutaa haasawa waraabame dhiheessite, qaamni mormituu guutummaa dhaamsa naannoo jiru gaafachuu danda'a, abbootiin murtii immoo fakkiiwwan muraman kanneen chaappaa yeroo ykn ergaawwan duraa dhiisan hin amanu. Dhangala’aa haasawa tartiiba yeroo guutuu maxxansaa.
8. Meesha Orijinaalaa FI Faayilii Duubdeebii Hashed SHA-256 (Seera Ragaa Irra Caalu - Seera FRE 1002 & Of-Mirkaneessuu - Seera FRE 902(14)):
9. Bilbila qaama qabatamaa (chaarjii fi qulfii hin qabne) gara minjaala dhaddacha mana murtiitti fidaa, akka abukaatoon mormituu maxxansaa sana morme, abbaa murtiitti akkas jettee itti himtu: "Kabaja kee, meeshaa jalqabaa bu'uura Seera Ragaa Irra Caaluun sakatta'iinsa Mana Murtiitiif as gabatee gorsaa irratti qaba."
10. Dabalataanis, Seera Ragaa Federaalaa 902(14) (fi kanneen kanaan walgitan kan kutaa biyyaa guutuu US keessatti fudhataman) jalatti, daataa meeshaa elektirooniksii irraa waraabame of-mirkaneessa yoo ta’u, mirkaneessa barreeffamaa gatii haashii dijitaalaa SHA-256 kan baafannaa jalqabaa fi waraabbii ibsu waliin yoo deemu.
11. "Labsii Barruu/Ergaawwan Chaatii Elektirooniksii Mirkaneessuu" Mallattaa'e (Unkaa waraabbii fi maxxansi armaan gadii):

DECLARATION AUTHENTICATING ELECTRONIC MESSAGE EVIDENCE
(Pursuant to Federal Rules of Evidence 901(b)(1), 901(b)(4), and 902(14) / State Equivalents)

I, [YOUR FULL LEGAL NAME], declare under penalty of perjury under the laws of the State of [STATE] and the United States of America that the following is true and correct:

1. I am the [Plaintiff / Defendant / Petitioner / Respondent] in this action and have personal knowledge of the facts set forth herein.
2. I am the sole owner and user of the [Apple iPhone / Android Smartphone], assigned telephone number [YOUR 10-DIGIT PHONE NUMBER].
3. Attached hereto as EXHIBIT A is a true, complete, and unedited chronological transcript and printout of [SMS / iMessage / WhatsApp / Signal] messages exchanged between my telephone number ([YOUR NUMBER]) and [NAME OF OTHER PARTY] at telephone number [OTHER PARTY'S 10-DIGIT PHONE NUMBER] between [START DATE] and [END DATE].
4. I personally know that telephone number [OTHER PARTY'S NUMBER] belongs to and is used by [NAME OF OTHER PARTY] because: (a) we have communicated at that number regularly since [YEAR]; (b) I have spoken to [NAME OF OTHER PARTY] by voice call at that exact number and recognized their voice; and (c) the messages inside Exhibit A contain distinctive personal facts, photographs, and references known uniquely to [NAME OF OTHER PARTY] (pursuant to FRE Rule 901(b)(4) Distinctive Characteristics).
5. Not a single message, timestamp, or attachment in Exhibit A has been altered, deleted, or modified in any way. On [DATE OF EXTRACTION], a complete forensic backup of the original messaging database (`[FILENAME, e.g., sms.db / msgstore.db]`) was preserved prior to printing Exhibit A, yielding the following cryptographic SHA-256 hash fingerprint:
   SHA-256 Hash: [INSERT 64-CHARACTER HEXADECIMAL SHA-256 HASH FROM sha256sum / Get-FileHash]
6. Attached hereto as EXHIBIT B are true and correct copies of my official mobile carrier call/message detail records from [NAME OF CARRIER] independently corroborating the dates, times, and telephone numbers of the communications.
7. The original smartphone device and the SHA-256 verified backup archive remain in my secure custody and are available for immediate inspection by the Court.

Executed on [DATE] at [CITY, STATE].

____________________________________
[YOUR SIGNATURE]
[YOUR PRINTED NAME]

Gaaffiiwwan yeroo baay’ee gaafataman¶

Maddoonni sakatta'aniiru¶

• Inistiitiyuutii Istaandardii fi Teeknooloojii Biyyaalessaa (NIST, Yunaayitid Isteetis): *Maxxansa Addaa NIST 800-101 Mul.
• Waajjira Bulchiinsa Manneen Murtii Yunaayitid Isteetis: Dambii Ragaa Federaalaa (FRE) Dambii 106 (Barreeffamoota Hafan ykn Walqabatan ykn Ibsa Galmaa’e), Dambii 901(b)(1), (b)(4), fi (b)(9) (Ragaa Elektirooniksii Mirkaneessuu), Dambii 902(13) fi 902(14) (Daataa Mirkanaa’e irraa waraabame Meeshaa Elektirooniksii karaa Hash Value), fi Seera 1002 (Ulaagaalee Orijinaala).
• Konsortiimii SQLite: Gokumantii SQLite Ofiisaa Galmee Dura Barreessuu (Haala WAL), Akkaataa Faayilii Kuusaawwan Deetaa Manca'an, Fuula Tarree Bilisaa, fi .recover Ajaja CLI.
• Apple Inc.: Qajeelfama Nageenya Waltajjii Apple (Gitsa Eegumsa Deetaa, Jalqaba Hiikuu Dura vs Jalqaba Hiikkamuu Booda Sadarkaa Furtuu, fi Caasaa Manifest Duubdeebii iTunes/Finder).
• Garee Hojii Saayinsii Ragaa Dijitaalaa (SWGDE): Muuxannoo Gaarii Fooreensikii Bilbila Mobaayilaa fi Qormaata Kuusaa Deetaa SQLite.

Qajeelfamoota walqabatan¶

• Bilbila cabe ykn bishaaniin miidhame: baraarsa daataa hatattamaa
• Faayila akka tasaa haquu, diraayiviin foormaatii ta'e, fi suuraa deebisuu
• Faayila Word, Excel, PDF, ykn kuusdeetaa deebisuu manca'e
• Waamicha ragaa ba’uuf, waamicha himannaa, fi yeroo xumuraa oomisha sanada
• Ajaja dhorkaa, ajaja eegumsaa, fi ajaja yeroo hatattamaa
• Lakkoofsa balaa tasaa addunyaa