Anyone offering this service yet?

[Disklabs]

Is anyone offering Blackberry forensics yet?

If so, can you get metadata from them?

Please advise,

Simon

[f0r3nsixed]

I just found this group otherwise I'd have posted earlier.
Great document here
http://www.rh-law.com/ediscovery/Blackberry.pdf

I have recovered data from a blackberry 7230 I had no special reason to worry too much about write protection to the device, what I performed was it was just recovery of deleted phone numbers and notes and email for a client. I never found any way of proving or disproving if any changes were made to the file-system. I did make a second image/backup of the device about 10 mins after the original and the hashes matched. I carried out my examination / recovery with FTK.

[Disklabs]

Good post and excellant paper.

Thanks,

Disklabs

[iAndy]

That is a good paper. Problem is that the paper is 5 years old and things have changed quite a bit. RIM now provide a Java Development Kit (http://na.blackberry.com/eng/developers/downloads/) as opposed to the C++ SDK the paper refers to, the devices use USB not RS232 serial ports and are much higher spec. It does however still prove useful for earlier Blackberrys which are obviously still knocking about.

But I have had the same problem that you have had, finidng anything worth while and detailed, let alone modern, to do with Blackberry Forensics other than this single document. It seems to be a very grey area.

Radio Tactics Ltd are working to add Blackberry support to their products soon, but they tell me they are not there yet.

The only commercially available product i can find is a Paraben Device.

If you know of more products or more sources where I could get information on Blackberry Forensics I'd very much appreciate it. It seems an up hill struggle to learn anything about this topic.

[Disklabs]

We at Disklabs (http://www.disklabs.com) are now ripping lots of data from Blackberry devices. Where we are best though is working on supposedly 'non-working' devices. We are also able to 100% delete data from Blackberry's, which we also believe is a new thing.

As for Paraben, then thats up to you to try, but I have to be honest, I have heard both positive and negative thoughts on their kit.

Simon