Ukufumana kwakhona imiyalezo yobungqina evela kwifowuni eyonakeleyo okanye i-backup yengxoxo eyonakele¶

Xa ityala lembambano elibalulekileyo, idabi lenkundla yosapho, ukuvalelwa komyalelo wothintelo, isikhalazo soxhatshazo emsebenzini, ingxabano yobuqhophololo bokontraka, okanye ukhuselo lolwaphulo-mthetho luxhomekeke kwimiyalezo ebhaliweyo, iincoko ze-WhatsApp, ii-iMessages, okanye imisonto yeSiginali evaleleke ngaphakathi kwefowuni eyaphukileyo okanye ifayile yogcino eyonakeleyo, ukucofa okukodwa okungalunganga kunokutshabalalisa ngokusisigxina ubungqina bakho obusemthethweni. Oovimba bemiyalezo banamhlanje abayigcini imiyalezo njengeefayile ezibhaliweyo ezilula; bazigcina ngaphakathi kobudlelwane SQLite yogcino-lwazi (sms.db kwi-iOS, mmssms.db / bugle_db kwi-Android, msgstore.db.crypt14 / crypt15 kuWhatsApp, kunye noovimba beenkcukacha zeSQLCipher kwiSiginali) ehamba nethutyana Bhala-Phambili Log (.db-wal) iifayile zejenali.

Ukuba ngempazamo uvumela ifowuni entsha ibhale ngaphezulu ilifu lakho elinye eligciniweyo ngesiseko sedatha esingenanto, okanye ukuba uvula isiseko sedatha eyonakalisiweyo yeSQLite ngaphandle kokukopa efihliweyo. -wal ifayile kuqala, okanye ukuba ungenisa izikrini ezisikiweyo, ezingangqinisiswanga elichaswa ligqwetha elichasayo njengenkohliso, unokuphulukana nedatha kunye netyala lenkundla.

Esi sikhokelo sibonelela ngenyathelo ngenyathelo lokutsalwa kwengxoxo engonakalisi, ukulungiswa kwesiseko sedatha yeSQLite, ukubuyiselwa kokugcinwa kwe-cryptographic, kunye neeprothokholi zokugcinwa kwenkundla ezivunyiweyo ezisekelwe kwiNational Institute of Standards and Technology (NIST) Ushicilelo oluKhethekileyo 800-101 Rev. 1 (Izikhokelo kwiForensics yeSixhobo seMobile), iFederal Rules of Evidence (9RE) (9REB) (9REB) (9) I-902 (14) (UbuQinisekisa boBungqina be-Electronic nge-SHA-256 Hash Certification), kunye neenkcukacha ezisemthethweni zeSQLite / SQLCipher recovery.

Yenza oku ngoku¶

Ukuba ufuna ukuhlangula isicatshulwa esibalulekileyo okanye imiyalezo yencoko kwifowuni eyonakeleyo, umsonto ocinywe ngengozi, okanye ukugcinwa kwe-backups engaphumeleliyo:

1. Beka ifowuni kwiMowudi yeNqwelomoya ngoko nangoko kwaye Ucime iCloud ngokuzenzekelayo / i-Google Drive Backup. Lo ngumthetho we-#1 we-forensics ephathwayo. Ngoba? Okokuqala, xa ucima umyalezo kwiMessage (sms.db), WhatsApp (msgstore.db), okanye iMiyalezo ye-Android, okubhaliweyo akucinywanga kwangoko kwi-flash drive, kuhlala ngaphakathi kwedathabheyisi yeSQLite "Uluhlu lwasimahla / lwamaphepha angabiwanga" okanye ngaphakathi kwethutyana Bhala-Phambili Log (.db-wal) de idatabase iqhube imvelaphi VACUUM coca okanye enze imiyalezo emitsha ngaphezulu kwayo. Okwesibini, ukuba umyalezo ucinyiwe kwifowuni yakho namhlanje, **ugcino lwakho lokugqibela lwe-02:00 AM iCloud Backup okanye i-Google Drive WhatsApp Backup isenomyalezo opheleleyo **, de i-Wi-Fi yanamhlanje igcina i-backup. Ukuvula iMowudi yeNqwelomoya kumisa ukubhala ngaphezulu kweSQLite yasekhaya kunye nokubhala ngaphezulu kogcino lwamafu ngoko nangoko. Ukuba usengozini ngoko nangoko evela kumxhaphazi wasekhaya okanye umntu ochwechwelayo onemiyalezo oyigcinayo, yiya kwindawo yokhuseleko kuqala kwaye utsalele umnxeba kwinombolo yakho yexesha likaxakeka (911 eUnited States naseKhanada, 112 ngapha kweEuropean Union, 999 eUnited Kingdom) okanye ujonge amanani kaxakeka.
2. ** Ungaze ufake okanye ungene kwi-WhatsApp okanye iSiginali kwifowuni entsha kwaye ucofe u- "Back Up Ngoku" ngaphambi kokubuyisela i-archive yakho endala.** Izigidi zabasebenzisi zilahlekelwa yiminyaka yobungqina be-WhatsApp xa ubeka ifowuni yokubuyisela: ukuba utsiba i-prompt yokuqala yokubuyisela (okanye ukuba ukubuyisela kuyasilela kwiipesenti ezingama-99) kunye nofakelo olutsha olungenanto lwe-WhatsApp luqhuba i-backup ngokuzenzekelayo kwi-Google Drive okanye iCloud, i-multi-kilogigayidi yembali ugcino olungenanto**.
3. Ukuba isikrini sefowuni simnyama okanye saphukile (i-digitizer yokuchukumisa yaphukile) kodwa ifowuni isangcangcazela okanye i-chimes, UNGAYAYI ukuphinda uyiqalise. Kuzo zombini ii-iOS kunye ne-Android (I-File-Based Encryption / Phambi kokuVula kokuQala - BFU vs Emva kokuVulwa kokuQala - AFU), okoko nje ifowuni ivulwe kanye ukusukela oko yaqalayo kwakhona.AFU urhulumente), izitshixo ze-cryptographic ezikhusela i-database yomyalezo wakho zihleli zikhutshiwe kwi-RAM, ekuvumela ukuba uplage $15 USB-C / Umbane hub enentambo USB mouse mouse kunye HDMI esweni ukucofa. "Trust This Computer" kwaye utsale i-backup epheleleyo yendawo. Ukuba unyanzelisa-ukuqalisa kwakhona ifowuni ngesikrini esaphukileyo, iyangena BFU indawo etshixekileyo apho kungekho mouse ye-USB okanye ikhomputha enokuyivula ngaphandle kokulungisa isikrini kuqala (bona isikhokelo sethu ukubuyiswa kwefowuni ephukile okanye eyonakaliswe ngamanzi).
4. Nanini na ukhuphela idatabase yeSQLite ekrwada (sms.db okanye msgstore.db), HLALA ukhuphela iifayile ezintathu zabantwana kunye (.db, .db-wal, kwaye .db-shm). Yonke idatabase yemiyalezo yangoku ehambahambayo isebenza kwimowudi SQLite WAL (Bhala-Ngaphambili). Iintsuku zakho zamva nje okanye iiveki zemiyalezo zihlala zihleli ngaphakathi kwiqabane sms.db-wal okanye msgstore.db-wal ifayile, HAYI ngaphakathi kwengundoqo .db ifayile okwangoku. Ukuba ukhuphela kuphela sms.db kwaye uhambe sms.db-wal ngasemva, eyona miyalezo yamva nje iyanyamalala okanye ugcino lwedatha luvula njengokonakala.
5. Bala kwaye urekhode i-cryptographic SHA-256 hash yayo nayiphi na i-backup ethunyelwe ngaphandle okanye ifayile yedatabase ngokukhawuleza. Phambi kokuba uvavanye okanye uguqule nayiphi na ifayile egciniweyo efunyenweyo, sebenzisa sha256sum (Linux/macOS) okanye Get-FileHash -Algorithm SHA256 (Windows PowerShell) kwindawo yokugcina yokugcina kwaye ugcine umtya we-hash onamagama angama-64. Ngaphantsi kwe-Federal Rule yoBungqina 902(14), ixabiso le-SHA-256 le-hash ngumgangatho wegolide wobungqina enkundleni ukuba umyalezo wakho wedijithali awuzange uguqulwe okanye ufotwe.

flowchart TD
    A["Isidingo esiNgxamisekileyo sokuBuyisa kwakhona kwaye ugcine iMiyalezo yoBungqina (iSMS, iMessage, WhatsApp, Signal)"] --> B["UKUZENZA NGOKUKHAWULEZA: Yenza iMowudi yeNqwelomoya kwifowuni kwaye ucime i-auto-cloud backup kwezinye izixhobo"]
    B --> C{"Ithini imeko yangoku yefowuni kunye nemiyalezo?"}
    C -->|"1. Ifowuni iyasebenza, kodwa imiyalezo icinywe ngempazamo"| D["Khangela ukuba i-Cloud Backup (iCloud / Google Drive) okanye i-WhatsApp yasekuhlaleni '/IiDatabases' ifolda ine-snapshot yokucinywa kwangaphambili"]
    D --> E["Ngaphambi kokubuyisela ngefowuni ephilayo: Okokuqala thatha i-Encrypted Backup yasekhaya egcweleyo kwiPC/Mac (`idevicebackup2` / iTunes / Finder / ADB) ukugcina uluhlu lwasimahla lweSQLite WAL"]
    C -->|"2. Isikrini sefowuni saphukile / simnyama, kodwa ibhodi isenamandla"| F["Sukuphinda uqalise (Gcina kwimo 'emva kokuvula kokuQala'); qhagamshela i-USB-C/Ihubhu yoMbane + Imowuzi eneNcingo ye-USB + Isiboniso se-HDMI ukuze uvule kwaye ugunyazise ugcino lwePC"]
    C -->|"3. Ncokola ifayile yogcino okanye idatabase yeSQLite (`sms.db`, `msgstore.db`, Signal) yonakele / ayibuyi umva"| G["Khuphela ZONKE iifayile EZINTATHU (`.db`, `.db-wal`, `.db-shm`) kulawulo olusebenzayo kwiPC/Mac"]
    G --> H{"Ngaba idatabase ifihliwe (`crypt14/crypt15` okanye SQLCipher) okanye iSQLite eqhelekileyo?"}
    H -->|"I-WhatsApp Efihliweyo / Umqondiso"| I["Decrypted usebenzisa i-64-char E2EE Iqhosha / `/data/data/com.whatsapp/files/key` (`wa-crypt-tools`) okanye uMqondiso webinzana lokugqithisa elinamanani angama-30 (`izixhobo zogcino-zomqondiso`)"]
    H -->|"Idecrypted / iSQLite esemgangathweni"| J["Lungisa amaphepha omthi we-B awonakeleyo usebenzisa `sqlite3 .ubuyise` okanye uqingqe iirekhodi ezicinyiweyo kuLuhlu olukhululekileyo kunye nezakhelo ze-WAL"]
    E --> K["Qinisekisa ngeNkundla: Yenza i-SHA-256 Hash + I-PDF enemisonto egcweleyo enee-CDR ze-Carrier + FRE 902(14) isiBhengezo"]
    I --> K
    J --> K

Uyilo lokugcinwa komyalezo ophathwayo: Apho imiyalezo yakho ihlala khona¶

Ukufumana kwakhona imiyalezo ecinyiweyo okanye eyonakeleyo ngaphandle kokuyitshabalalisa, kuya kufuneka uqonde apho inkqubo nganye yokusebenza kunye neqonga lokuthumela imiyalezo ligcina isiseko sayo sedatha ephilayo, izitshixo zayo zoguqulelo oluntsonkothileyo, kunye nee-backups zasekhaya eziqengqelekayo:

Imeko 1: Ukufumana kwakhona imiyalezo ecinyiweyo okanye eyonakeleyo ye-iPhone (sms.db & ChatStorage.sqlite)¶

Ukuba i-iMessages ebaluleke kakhulu, iitekisi zeSMS, okanye imiyalezo ye-WhatsApp yacinywa kwi-iPhone, okanye ukuba i-iPhone yonakele, landela la manyathelo ngokuthe ngqo ngokulandelelana okuphambili:

Inyathelo 1: Jonga i-iOS eyakhelwe-ngaphakathi "Esanda kucinywa" ivault (ientsuku zokuqala ezingama-30 ukuya kwezingama-40)¶

Kwi-iOS 16, i-iOS 17, i-iOS 18, kunye nentsha, ukucima isicatshulwa okanye i-iMessage intambo ayifuni ** ayishukumisi ngokukhawuleza kwisithuba soluhlu lwasimahla lweSQLite; iyishenxisa kwisiqulathi seefayili esifihlakeleyo senkunkuma ientsuku ezingama-30 (ukuya kuthi ga kwiintsuku ezingama-40 phambi kokucocwa ngokusisigxina): 1. Vula i **Imiyalezo ** app kwi iPhone. 2. Cofa Hlela (okanye Amacebo) kwikona ephezulu ekhohlo. 3. Cofa Bonisa esandula kucinywa. 4. Khetha incoko kwaye ucofe Buyisa.

Inyathelo lesi-2: Khupha sms.db kwaye ChatStorage.sqlite ukusuka kwi-Local Mac / Windows Backup ngaphandle kokubhala ngaphezulu nantoni na¶

Ukuba umyalezo ucinywe ngokusisigxina ku-"Kutsha nje ukucinywa" (okanye ukuba ufuna ukukhupha imiyalezo yenkundla okanye ukrole imiqolo ecinyiweyo yeSQLite), ** yenza ugcino olupheleleyo lwendawo kwikhompyuter ngokukhawuleza ngelixa ifowuni ikwiMowudi yenqwelomoya**:

1. Qhagamshela i-iPhone ngentambo ye-USB kwiMac (Finder) okanye kwiWindows PC (izixhobo zeApple / iTunes) okanye kwiLinux (libimobiledevice):
2. Khangela ibhokisi ethi "Shicilela ugcino lwangaphakathi" kwaye usete igama eligqithisiweyo elilula ongayi kulilibala (njenge Evidence1234). (Kutheni uvule ufihlo olugcinwayo? Ugcino olufihliweyo lwasekhaya lwe-iOS luquka izinto zakudala ezongezelelweyo, idatha yezempilo, imbali yomnxeba, kunye nezinto ezizitshixo ezihluthwa ngu-Apple kwiikopi ezingafihlwanga).
3. Cofa u-Back Up Ngoku* kwaye ulinde ukuba igqibe.
4. ** Fumana ifolda yokugcina ekrwada kwikhompyuter yakho: **
5. macOS: -/Library/Application Support/MobileSync/Backup/<UDID>/
6. IiWindows: %APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\ okanye %USERPROFILE%\Apple\MobileSync\Backup\<UDID>\
7. ** Khuphela yonke loo nto <UDID> ifolda ukuya kwiDrive yangaphandle eyohlukileyo ngoko nangoko kwaye ubale i-SHA-256 hash** yayo ukuze umfanekiso wakho woqobo we-forensic ungaze uguqulwe.
8. ** Fumana eyona datha yedatha yemiyalezo ngaphakathi kwe-iOS Backup usebenzisa i-Apple's SHA-1 Domain Hashes:**
9. I-Apple ithiya ngokutsha yonke ifayile ngaphakathi kwe-iOS yogcino kwi SHA-1 hash yayo Domain-RelativePath, ihlelwe yaba ngabalawuli abancinci ababini:
   • ** Apple SMS / iMessage Database (HomeDomain-Library/SMS/sms.db):** Ifumaneka kwisiqulathi seefayili 3d/ -> ifayile 3d0d7e5fb2ce288813306e4d4636395e047a3d28
   • ** WhatsApp iOS Database (AppDomainGroup-group.net.whatsapp.WhatsApp.shared-ChatStorage.sqlite):** Ifumaneka kwisiqulathi seefayili 7c/ -> ifayile 7c7fba66680ef796b916b067077cc246adacf01d
   • Ugcino lweFayile yesalathiso (Manifest.db): Isalathiso esikhulu seSQLite esenza imephu yonke ifoto enye, imemo yelizwi, kunye nehashi yokuncamathela kwigama layo lokwenyani lefayile SMS/Attachments/.
10. (Ukuba wenze ufihlo olugcinakeleyo, cima ikopi esebenzayo yogcino kwifolda efundekayo usebenzisa izixhobo ezivulelekileyo ezifana iphone-backup-decrypt kwiPython okanye ababukeli abahloniphekileyo basekhaya bathanda iMazing okanye iBackup Viewer).

Imeko 2: Ukubuyisela kwakhona i-Android WhatsApp .crypt14 / .crypt15 kunye noMqondiso .backup oovimba¶

1. Ukuhlangula i-backup ye-WhatsApp endala ngaphambi kokuba i-7-day rolling window iphelelwe lixesha¶

Kuthekani ukuba umntu ucime incoko ka-WhatsApp ebambekayo kwifowuni yakho ye-Android kwiintsuku ezi-3 ezidlulileyo, kwaye phezolo ngo-02:00 AM I-backup kaGoogle Drive sele iyibhalile ikopi yelifu? - Qhagamshela ifowuni yakho ye-Android kwikhompyuter nge-USB (kwi-Fayile yokuGqithisela / imowudi ye-MTP) okanye uvule i-Android Iifayile app kwaye uye ku:

Internal Storage/Android/media/com.whatsapp/WhatsApp/Databases/

2. Ukucima ukuntsonkotha konakele .crypt14 / .crypt15 WhatsApp backups kwikhompyuter (wa-crypt-tools)¶

Kuthekani ukuba ifayile yogcino lwe-WhatsApp iphazamiseka kwiipesenti ze-95 ngexesha lokubuyiswa kwefowuni kuba i-database ye-SQLite ngaphakathi kwe-wrapper efihliweyo yonakaliswa kancinci? Uyakwazi ukususa uguqulelo oluntsonkothileyo kwi .crypt14 okanye .crypt15 isikhongozeli ngqo kwikhompyuter yakho, lungisa idatabase yeSQLite, kwaye ufunde wonke umyalezo: - Ukuba unayo .crypt15 Ukuphela-ukuya-ekuMphelweni okuKhuselweyo okuKhuselweyo kwaye ugcine isitshixo se-hexadecimal enamanani angama-64 (okanye ukuba ulukhuphile /data/data/com.whatsapp/files/key okanye encrypted_backup.key), faka i-open-source Python forensic tool wa-crypt-tools (wagolek):

# Install wa-crypt-tools on Linux, macOS, or Windows Python:
python3 -m pip install wa-crypt-tools

# Decrypt a WhatsApp .crypt15 backup using your 64-character hex key:
wadecrypt <your_64_character_hex_key> msgstore.db.crypt15 msgstore.db

# Or decrypt a .crypt14 backup using the extracted 158-byte key file:
wadecrypt key msgstore.db.crypt14 msgstore.db

3. Ukukhupha kunye nokulungiswa kweSiqondiso esonakeleyo .backup okanye iDatabase yeDesktop yoMqondiso¶

• Ye Android signal-YYYY-MM-DD.backup iifayile: Ukuba ifowuni entsha iyala ukurhweba ngaphandle ifayile enkulu yokugcina uMqondiso (okanye ukuba ifayile yanqunyulwa xa kukhutshelwa ikhadi le-SD elifayo), sebenzisa isixhobo esivulelekileyo senkundla signalbackup-tools (github.com/bepaald/signalbackup-tools) nge30 ibinzana logqitho lamanani eligcinwayo ukukhupha izakhelo ezingonakaliswanga, thumela ngaphandle ugcino lwedatha ekrwada yeSQLite, kwaye wenze incoko yeHTML ecocekileyo, ephendlayo yogcino oluneenkcukacha ezincamatheleyo zingaguquki:

  # Unpack a Signal Android backup (including truncated/partially corrupted archives) to HTML:
  signalbackup-tools signal-2026-10-30.backup "12345 67890 12345 67890 12345 67890" --exporthtml ./recovered_signal_chats/
  

• YeDesktop yoMqondiso (-/.config/Signal/sql/db.sqlite): Nokuba i-smartphone yakho yatyunyuzwa kwingozi yemoto okanye yaphoswa echibini kwaye awunazo ii-backups zefowuni, ukuba ilaptop yakho yakha yaba ne-Signal Desktop* eqhagamshelwe, khuphela lonke uxwebhu lwesicelo soMqondiso (%APPDATA%\Signal kwiWindows, -/Library/Application Support/Signal kwi-macOS, okanye -/.config/Signal kwiLinux) phambi kokuvula usetyenziso, kwaye ukhuphele ngaphandle isiseko sedatha seSQLCipher usebenzisa signalbackup-tools okanye sqlcipher.

Imeko 3: Ukulungisa isiseko sedatha yengxoxo yeSQLite eyonakeleyo (database disk image is malformed) kunye nokukrola imiqolo ecinyiweyo¶

Xa ifowuni ilahlekelwa amandla ebhetri phakathi-bhala okanye ubandezeleka iimpazamo zokugcina flash, ukuvula sms.db, ChatStorage.sqlite, okanye msgstore.db iphosa impazamo ebulalayo yeSQLite: Error: database disk image is malformed (SQLITE_CORRUPT)

Ungaze usebenzise i-shareware eyonakalisayo umntu wesithathu "ihlawulwe iSQLite fixer" kwisiseko sedatha sakho sokuqala. Sebenzisa esemthethweni SQLite .recover umyalelo eyakhelwe ngqo kwi sqlite3 (uguqulelo 3.29.0+), oluskena i-4-kilobyte ekrwada kumaphepha edatha enye enye ngokugqitha ezaphukileyo izikhombisi zesalathiso somthi we-B:

Inyathelo ngenyathelo SQLite .recover kunye nokulungiswa kwendawo yokuhlola i-WAL¶

1. Yenza ikopi esebenzayo yazo zontathu iifayile zedatha (.db, .db-wal, .db-shm) kwisiqulathi seefayili esitsha:

   mkdir ~/chat_rescue && cp sms.db* ~/chat_rescue/ && cd ~/chat_rescue/
   

2. Sebenzisa iSQLite esemthethweni .recover umyalelo wokwakha kwakhona isiseko sedatha esicocekileyo (kwaye ubambe iirowu ezilahlekileyo/zoluhlu lwasimahla):

   # Standard recovery of all intact tables and rows into a brand-new healthy database:
   sqlite3 sms.db ".recover" | sqlite3 sms_repaired.db
   
   # FORENSIC DELETED-ROW RECOVERY: Add the --ignore-freelist flag so SQLite ALSO recovers
   # deleted message fragments still sitting inside unallocated freelist pages into a 'lost_and_found' table:
   sqlite3 sms.db ".recover --ignore-freelist" | sqlite3 sms_forensic_with_deleted.db
   

3. Thumela ngaphandle umbhalo ofundeka ngumntu, wolandelelwano lwe-CSV/HTML ukusuka kuvimba olungisiweyo:
4. ** Kuba Apple iOS sms.db (Ukuguqula i-Apple's CoreData Nanosecond Timestamp ukusukela nge-1 Jan, 2001 ukuya kwi-UTC/Umhla weNdawo):**

   sqlite3 -header -csv sms_repaired.db "
   SELECT
       m.ROWID AS MsgID,
       datetime(m.date / 1000000000 + 978307200, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.is_from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       h.id AS Contact_Phone_Or_Email,
       m.service AS Service_Type,
       m.text AS Message_Body,
       a.filename AS Attachment_Path
   FROM message m
   LEFT JOIN handle h ON m.handle_id = h.ROWID
   LEFT JOIN message_attachment_join maj ON m.ROWID = maj.message_id
   LEFT JOIN attachment a ON maj.attachment_id = a.ROWID
   ORDER BY m.date ASC;
   " > recovered_imessage_transcript.csv
   

5. KuWhatsApp Android msgstore.db (Yale mihla message iskimu setafile):

   sqlite3 -header -csv msgstore_repaired.db "
   SELECT
       m._id AS MsgID,
       datetime(m.timestamp / 1000, 'unixepoch', 'localtime') AS Timestamp_Local,
       CASE WHEN m.from_me = 1 THEN 'SENT BY ME' ELSE 'RECEIVED' END AS Direction,
       jid.raw_string AS Chat_Or_Sender_JID,
       m.text_data AS Message_Body
   FROM message m
   LEFT JOIN chat c ON m.chat_row_id = c._id
   LEFT JOIN jid ON c.jid_row_id = jid._id
   ORDER BY m.timestamp ASC;
   " > recovered_whatsapp_transcript.csv
   

Ukwenza imiyalezo yakho efunyenweyo 100% ivunywe enkundleni (Ukunqanda ukuchaswa kwe "Fake Screenshot")¶

Rhoqo ngeveki kwinkundla yosapho, inkundla yamatyala amancinci, amatyala othintelo, kunye namatyala oluntu, abantu baya ejajini bephethe izikrini ze-smartphone ezikhululekileyo, apho i-header ephezulu yomfowunelwa ithetha nje igama lesiqhulo. "Ex-Husband" okanye "Landlord Mike" kungekho nombolo yefowuni kwaye akukho mihla epheleleyo. Abameli abachasayo bachasa ngokukhawuleza phantsi kwe-** Federal Rule of Evidence 901 (Lack of Authentication)** kunye Umthetho we-106 (uMthetho wokuGqibela), bephikisana ukuba nabani na unokuthiya ngokutsha ifowuni yesibini ehlawulwa ngaphambili. "Landlord Mike" kwi-app yabo yoqhagamshelwano kwaye babhale imiyalezo yobuxoki kwimizuzwana engama-30.

I-5-Point Courtroom Authentication Checklist for Text & Chat ubungqina¶

1. Cima okwethutyana okanye uQambe ngokutsha iSiteketiso soMfowunelwa phambi kokuba uThunyelelwe ngaphandle/uJonga umfanekiso-skrini ukuze iNombolo yeFowuni ekrwada (+1-555-019-2834) okanye I-imeyile Ivela kuyo yonke imibhalo engasentla:
2. Ngaphambi kokuthatha i-screenshots ye-backup (okanye ngcono okwangoku, sebenzisa isixhobo esipheleleyo sokuthumela ngaphandle kwePDF njenge iMazing, Decipher TextMessage, okanye umbuzo weSQLite CSV ongentla oprinta zombini igama elibonisiweyo KUNYE nekrwada handle.id inombolo yefowuni kwiqamza ngalinye lomyalezo), qinisekisa ukuba inombolo yefowuni enamanani ali-10 yokwenyani okanye i-imeyile ye-ID ye-Apple yomthumeli ibonakala phezulu komsonto, hayi nje isiqhulo somfowunelwa owenzekayo.
3. ** Tsala iiNgcaciso zeNgcaciso zeNgcaciso zeNgcaciso zeSelfowuni (CDRs) kunye ne-SMS/MMS yeSitampu seTimesi eLokhu njengeNgcaciso yeQela leSithathu eliZimeleyo:**
4. Ngelixa umnikezeli wakho weselula (AT&T, Verizon, T-Mobile, EE, Vodafone, Rogers, Telstra) engawugcini umxholo wombhalo wemiyalezo yeSMS ixesha elide (kwaye akazange abone iMessage/i-WhatsApp umxholo ofihliweyo), isitatimenti sakho senyanga okanye i-akhawunti ye-akhawunti ye-intanethi ibonelela nge- **Iqela lesithathu lokungena elizimeleyo loMhla ngokuthe ngqo, iMizuzu, iNombolo yokuNgena, iSMS kunye neNombolo yeSMS umyalezo kunye nefowuni yelizwi **.
5. Ukuncamathisela esemthethweni AT&T / Verizon / T-Mobile yokuSetyenziswa kweLog ngasemva kokuprintwa komyalezo wakho obhaliweyo ingqina ukuba inombolo yefowuni yomnye umntu ithumele iSMS kwifowuni yakho. 14:22:09 on October 12, utshabalalisa naliphi na ibango ozenzileyo umfanekiso wekhusi.
6. Thumela ngaphandle UMsonto weNgxoxo WOWONKE ONGAHLANGANISWAYO (UMthetho wokuGqibela - UMTHETHO WOKUPHELA 106):
7. Ungaze ukhethe ii-screenshots ezizimeleyo okanye ukhuphe ezakho iimpendulo. Ngaphantsi kwe-Federal Rule of Evidence 106, ukuba unikezela ngenxalenye yencoko erekhodiweyo, iqela elichasayo lingafuna wonke umsonto ojikelezileyo, kwaye abagwebi abayithembi imifanekiso eqingqiweyo eshiya izitampu zexesha okanye imiyalezo yangaphambili. Shicilela incoko epheleleyo ngolandelelwano lwamaxesha.
8. Gcina iSixhobo sokuqala KUNYE neFayile ye-SHA-256 Hashed Backup (Owona Mthetho woBungqina ogqwesileyo - FRE Rule 1002 kunye noZiqinisekiso-FRE Rule 902(14)):
9. Yiza neyona fowuni yokwenyani (ehlawuliweyo yaza yavulwa) kwitafile yenkundla yokumamela ukuze ukuba igqwetha elichasayo licel’ umngeni oko kushicilelweyo, uxelele ijaji: “Mhlonitshwa, ndinesixhobo sokuqala kanye apha kwitafile yabacebisi sokuhlolwa kweNkundla ngokungqinelana nowona Mthetho woBungqina obugqwesileyo.”
10. Ukongeza, phantsi kwe-Federal Rule of Evidence 902(14) (kunye nelizwe elilinganayo elamkelwa kulo lonke elase-US), idatha ekhutshelwe kwisixhobo sombane iyaziqinisekisa ngokwayo xa ikhatshwa sisiqinisekiso esibhaliweyo esichaza SHA-256 yexabiso le-hashi yedijithali yotsalo wokuqala kunye nekopi.
11. Qhoboshela "Isibhengezo esiSayiniweyo sokuQinisekisa iSibhalo se-Eletroniki/Imiyalezo yeNcoko" (Kopisha-uncamathisele itemplate engezantsi):

DECLARATION AUTHENTICATING ELECTRONIC MESSAGE EVIDENCE
(Pursuant to Federal Rules of Evidence 901(b)(1), 901(b)(4), and 902(14) / State Equivalents)

I, [YOUR FULL LEGAL NAME], declare under penalty of perjury under the laws of the State of [STATE] and the United States of America that the following is true and correct:

1. I am the [Plaintiff / Defendant / Petitioner / Respondent] in this action and have personal knowledge of the facts set forth herein.
2. I am the sole owner and user of the [Apple iPhone / Android Smartphone], assigned telephone number [YOUR 10-DIGIT PHONE NUMBER].
3. Attached hereto as EXHIBIT A is a true, complete, and unedited chronological transcript and printout of [SMS / iMessage / WhatsApp / Signal] messages exchanged between my telephone number ([YOUR NUMBER]) and [NAME OF OTHER PARTY] at telephone number [OTHER PARTY'S 10-DIGIT PHONE NUMBER] between [START DATE] and [END DATE].
4. I personally know that telephone number [OTHER PARTY'S NUMBER] belongs to and is used by [NAME OF OTHER PARTY] because: (a) we have communicated at that number regularly since [YEAR]; (b) I have spoken to [NAME OF OTHER PARTY] by voice call at that exact number and recognized their voice; and (c) the messages inside Exhibit A contain distinctive personal facts, photographs, and references known uniquely to [NAME OF OTHER PARTY] (pursuant to FRE Rule 901(b)(4) Distinctive Characteristics).
5. Not a single message, timestamp, or attachment in Exhibit A has been altered, deleted, or modified in any way. On [DATE OF EXTRACTION], a complete forensic backup of the original messaging database (`[FILENAME, e.g., sms.db / msgstore.db]`) was preserved prior to printing Exhibit A, yielding the following cryptographic SHA-256 hash fingerprint:
   SHA-256 Hash: [INSERT 64-CHARACTER HEXADECIMAL SHA-256 HASH FROM sha256sum / Get-FileHash]
6. Attached hereto as EXHIBIT B are true and correct copies of my official mobile carrier call/message detail records from [NAME OF CARRIER] independently corroborating the dates, times, and telephone numbers of the communications.
7. The original smartphone device and the SHA-256 verified backup archive remain in my secure custody and are available for immediate inspection by the Court.

Executed on [DATE] at [CITY, STATE].

____________________________________
[YOUR SIGNATURE]
[YOUR PRINTED NAME]

Imibuzo edla ngokubuzwa¶

Imithombo ijongiwe¶

• Iziko leSizwe leMigangatho kunye neTeknoloji (i-NIST, eUnited States): * I-NIST Special Publication 800-101 Rev. 1: Izikhokelo kwi-Forensics yeDivaysi ye-Mobile (Ukugcinwa, i-Airplane Mode RF Isolation, i-SQLite Database Artifacts, kunye noQinisekiso lweHash) *.
• I-Ofisi yoLawulo lweeNkundla zase-United States: * Imithetho ye-Federal yoBungqina (FRE) Rule 106 (Intsalela okanye iZibhalo eziNxulumeneyo okanye iiNkcazo eziRekhodiweyo), uMthetho we-901 (b) (1), (b) (4), kunye (b) (9) (Ukuqinisekisa ubungqina be-Electronic), uMthetho we-902 (02) ovela kwi-Data eqinisekisiweyo (i-149) kunye ne-Code 14 Isixhobo ngeHash Value), kunye neRule 1002 (Imfuno yeyoqobo)*.
• I-SQLite Consortium: UXwebhu olusemthethweni lweSQLite ngokuLonwa ngokuBhala-Phambili (iNdlela ye-WAL), iFomethi yeFayile yeeDatha zoBuqhophololo, amaPhepha oLuhlu lwasimahla, kunye .recover Umyalelo we-CLI.
• I-Apple Inc.: IsiKhokelo soKhuseleko seQonga le-Apple (Iiklasi zoKhuseleko lweDatha, phambi kokuVula kokuQala vs Emva kokuVula kokuQala koLawulo lweSitshixo, kunye ne-iTunes/Finder Backup Manifest Structure).
• IQela eliSebenzayo leNzululwazi kuBungqina beDijithali (SWGDE): *Iindlela ezigqwesileyo zeFowuni yeForensics kunye noVavanyo lweDatabase yeSQLite *.

Izikhokelo ezinxulumeneyo¶

• Ifowuni ephukile okanye eyonakaliswe ngamanzi: ukuhlangula idatha engxamisekileyo
• Ucimo lwefayile ngengozi, idrayivu efomathiweyo, kunye nokubuyisela ifoto
• ILizwi elonakeleyo, i-Excel, iPDF, okanye ukubuyiswa kwefayile yedatha
• I-subpoena yokunika ubungqina, ukufakwa kweisamani, kunye nemihla yokugqibela yokuvelisa amaxwebhu
• Imiyalelo yokuthintela, imiyalelo yokukhusela, kunye nezithintelo ezingxamisekileyo
• Iinombolo zikaxakeka zehlabathi