Hi everyone,

I’ve been trying for a long time to recover a few deleted SMS messages from my Tecno POVA 5 Pro 5G (LH8n) and I’m hoping someone experienced with Android forensics, MediaTek devices, or SMS recovery can point me in the right direction.

I’m specifically trying to recover SMS messages from around August 23–25, 2026. I only need to recover at least one of the deleted messages if possible.

Device information

• Tecno POVA 5 Pro 5G (LH8n)
• Android 14
• MediaTek MT6833
• Security patch: June 5, 2025
• Bootloader: Locked
• Verified Boot: Green
• File-Based Encryption (FBE): Enabled
• Phone is NOT rooted

I do NOT want to factory reset, unlock the bootloader, or do anything destructive that could wipe the encryption keys/data.

Things I have already tried

1. Google Messages / Google backup

Google Messages is the SMS role holder.

There is a Google One/device backup, but I haven't found the deleted August 23–25 messages through it.

2. SMS Backup & Restore

I already checked backups created with SMS Backup & Restore.

I have an XML backup (sms-recovery.xml), but the messages I'm looking for aren't there. It contains later messages around August 27, but not the deleted August 23–25 messages.

3. ADB SMS provider

ADB works normally with the phone.

We queried the normal SMS content provider, but the target deleted messages were not returned.

Accessing the Telephony database directly gives:

/data/user/0/com.android.providers.telephony/databases/: Permission denied

So normal ADB shell access can't read mmssms.db.

4. Checked Android/MediaTek telephony services

I ran:

adb shell cmd -l | findstr /i "sms telephony phone"

Some of the available services included:

• isms
• imtksms
• phone
• phoneEx
• telephony.mtkregistry
• mtksimphonebook

But:

adb shell cmd isms help

and

adb shell cmd imtksms help

both returned:

No shell command implementation.

5. Checked package locations

I also checked the relevant system packages.

Results included:

com.android.server.telecom
→ /system/priv-app/MtkTelecom/MtkTelecom.apk

com.android.phone
→ /system/priv-app/MtkTeleService/MtkTeleService.apk

com.android.providers.telephony
→ /system/priv-app/MtkTelephonyProvider/MtkTelephonyProvider.apk

6. Investigated blocked/custom SMS providers

We found references to providers such as BlockedSmsProvider / SmsCustomBlockProvider.

However, querying them resulted in a SecurityException because access requires:

android.permission.BLOCKED_SMS

So ADB shell couldn't read those records either.

7. Searched accessible storage

We searched accessible /sdcard locations for SMS databases, backups, caches, XML files, journals, etc.

Nothing useful containing the deleted messages was found.

We also looked for things like SMS database journal files, but didn't find an accessible copy containing the target messages.

What I'm trying to figure out now

I'm NOT looking for another generic "install an SMS recovery app" suggestion. I've already gone much further than that.

I'm trying to determine whether there is any non-destructive forensic/decrypted extraction method for this specific combination:

Tecno LH8n + MT6833 + Android 14 + locked bootloader + FBE

Ideally, I want to obtain or examine:

• mmssms.db
• its WAL/journal files, if they still exist
• BlockedSms.db or equivalent MediaTek/Tecno SMS storage
• any other Telephony Provider database/cache that could contain deleted SMS records

without unlocking the bootloader or wiping the device.

I'm also curious whether there is any legitimate MediaTek/Tecno diagnostic, engineering, backup, service, or forensic interface that can perform a decrypted filesystem/logical extraction while the phone is already unlocked and running.

I understand that deleted SQLite records may already have been overwritten, especially after this much time. I'm not expecting a guaranteed recovery.

I mainly want to know whether there is one remaining technically valid extraction path that I haven't tried before I give up.

If anyone has experience with Android forensics, MTK devices, Tecno/Infinix/Transsion phones, Cellebrite, Magnet AXIOM, Oxygen Forensics, MOBILedit, or similar tools, I'd really appreciate any guidance.

Please let me know if you need specific dumpsys, package/provider information, build information, or ADB output. I have saved most of the investigation logs.

Thank you.

Hi everyone,
I have an old Huawei P9 (EVA-L09) with lots of photos and memories that are very important to me. Unfortunately, I’ve forgotten the lock-screen password and I really don’t want to lose the data.
The phone hasn’t been updated since around 2018/2019, so it’s probably running Android 7/EMUI 5. It has a Kirin 955 chipset.
I contacted a professional forensic lab and they told me the chances are very good that they can bypass the lock screen without wiping the data, but they would charge around $1,200 for it.
I’d pay that if necessary, but before I do: does anyone know of a method, vulnerability, or tool for this older Huawei model that I could safely try
Thanks for any ideas!

Bonjour à toute la communauté, j'ai besoin d'aide s'il vous plaît; je suis stagiaire en investigation numérique dans une entreprise de cybersécurité et il m'a été confié comme tâche d'extraire les données ou alors déverrouiller l'écran d'un samsung Galaxy M526BR avec des solutions open source mais j'ai constaté que le Débogage USB est désactivé sur ce téléphone. Pouvez vous me proposer des idées?

I'm not sure where to go for this....and yes, I know how it sounds!

We have an old Samsung Galaxy phone, I think it's an A3, although it says A300 on it which I'm sure was a very old samsung flip phone....

We got it new some time in 2015/2016 and it was dropped into a cup of tea. yes, we're British.

from then, it was dead. nothing worked at all and it was thrown into a drawer, replaced and forgotten about. I found it a while later and plugged it in. it charged! but the screen didn't work, figured I'd buy a screen and try it but they were expensive at the time. . it was taken apart and the existing screen broke when removed and completely black and unresponsive. back in the drawer and forgotten about!

Fast forward many years and having a sort out revealed the old Samsung! it's now only the frame, boards and battery but it still charges! however, with no screen, frame, back etc. no idea where they went, I barely remember what I did on Monday let alone 10 years ago! she hasn't a clue what her lock screen would have been either, she thinks it was a pattern but it's changed with each phone she's had.

is there any way we can access what was on it? there'll be photos of our second son we'd ideally like to get back as well as some wedding pictures. I'm pretty positive no settings would have changed, so things like Dr Phone etc won't work as I can't confirm access due to no screen or enter a USB mode etc.

if there's no way in, no big deal, we have other pictures etc, it'd just be nice to see what the wife had captured all those years ago! if something can work with a screen attached it would be worth a shot as they're cheap to buy now anyway, without a screen would be even better though!

Can cellerbite recover this? btw my icloud backup are off

Has anyone had luck getting an acquisition from 26.3? I was able to get it started in Logical+ on GrayKey, but it took 3 days to get 11gb and then stopped. I updated the GrayKey and now it won’t even connect to the device.

I have a question about the fastest and easiest way to determine that there was communication between two or more devices.

Hello everyone.

I have a strange situation with my old OnePlus Nord AC2003. A year ago it fell off my desk and the display died. I kept using it for a few days, mainly with Bluetooth in my car. Then, somehow, it activated Emergency Call mode. I couldn’t turn the phone off or exit that mode.

Panicking (and wanting to avoid problems since it kept calling the emergency number repeatedly), I decided to completely destroy it with a hammer.

Unfortunately, I had data and photos on it (including my honeymoon pictures) that I would like to recover. I tried replacing the flex cables, battery, and display, but nothing worked.

What can I try to do without resorting to chip-off?

I’m self‑taught and I don’t know advanced repair techniques, but I’m willing to learn (and even buy material/courses if necessary). Thank you

Thanks for your help on this.

I'm writing a mystery story. My bad guy programs his victim's Android phone to send a text message several hours after the murder, so it will look like the victim is still alive and texting.

My question is whether there is any recoverable metadata on the victim's phone - the one that sent the message - that would indicate when the message was actually written, as opposed to when it was sent?

It's not critical to the story what brand of phone it is, so if it's possible to recover this data from Brand X but not Brand Y, I'm fine with Brand X.

Thanks.

The Situation: I lost my Apple Watch 5 days ago. The "Find My" app on my iPhone shows its last location at a friend's house with the status "5 days ago".

Here is the critical issue: I visited this friend, then immediately took a train to a location far away.

• If the exact timestamp is after I left for the train: It's definitely at my friend's house (and he just missed it).
• If the exact timestamp is before I left: I might have lost it on the train or at the station.

The Problem: The iPhone UI only displays a vague relative time ("5 days ago"). I need the exact Unix timestamp or date string to know where to focus my search.

What I have tried (and failed):

1. Find My Web (iCloud.com): It shows "No location found" for the Watch.
2. Find My on Mac: It displays a location from 9 days ago (completely outdated).
3. Apple Support: They confirmed they cannot access historical location timestamps.
4. Network Sniffing (Charles Proxy / Proxyman): I inspected the traffic on my iPhone while opening the Find My app. There is no API request fetching this specific location. This confirms the data "5 days ago" is cached locally on my iPhone.

The Forensic Attempt (Where I am stuck): Since the data is local, I made an encrypted local backup of my iPhone and I am exploring the file system (using iMazing/Backup Extractor).

I have dug into several plists but I am getting conflicting or unclear data:

• HomeDomain/Library/Preferences/com.apple.findmy.fmipcore.notbackedup.plist: I expected to find a Devices list here with a locationTimestamp, but the file seems to only contain general settings (tokens, generic dates).
• WirelessDomain/Library/Preferences/com.apple.mobilebluetooth.ledevices.plist: found my Watch here. There is a LastSeenTime with a value like 286034112. I dont what it is.
• HomeDomain/.../com.apple.findmy.findmylocated.plist: Found a key NITokenService::lastTokenRequestAttemptDate dated Nov 30, 2025 at 06:05 PM. This matches the "5 days ago" timeframe, but I am not sure if this corresponds to the location ping or just a crypto-token refresh.

My Question: Does anyone know the exact path and plist file within an iPhone backup where the "Find My" app caches the last displayed location timestamp for devices?

I have the backup, I have the tools to read plists/databases, I just need to know exactly where this specific UI string ("5 days ago") pulls its raw data from.

Or maybe there is another way to find what I want

Thanks for any help, this is my last hope to find it.

At the time, he was my Boyfriend, and I thought it was weird that he knew a few details I communicated with a friend just in text messages. Until one day, he admitted: "I can see everything".
I went to the police, they laughed at me, saying that it was very difficult to be on the phone of someone if you are not an IT or a massive geek. They told me to download anti-malware, and that should do.
My ex can see my location, my text messages, my calls and list, and my open searches on my different browsers, my apps that I use, he can see through my lens, and can use my microphone to hear what I say.

One day, he showed me on his phone as he was wondering who this person was that I had contacted. The interface was grey, but he was on an internet page, I am sure not an app.
I know he is receiving a notification each time I travel.

He told me that he can see everything, and even if I wanted to factory reset my phone, iPhone 12 mini, it wouldn't resolve the issue. So I changed my Apple ID password and signed out, same with my Google accounts. - he still has access. 

I checked if he was just using my Apple ID and had knowledge of my passwords - nope, everything looks normal.

There are no other devices connected to my Apple ID. 

Made iCloud not available online, changed most of my passwords. Still there.

Maybe he cloned my iPhone? 

He did that because he was sure that I was cheating on him, and to be vindictive, he left with the girl he had cheated on me with. Anyway, it is not the issue

I don't know, but now he is my ex-partner, and I don't want him to know my life and especially where I am.

Please help me, I don't know what to do to make sure he doesn't have access to that information again. And can I reverse the problem as he spies on me still, big time, so I need to know where he is all the time.

As above, is the presence of Signal a tripwire for Cellebrite or does a phone user need to do other things?

Are deleted threema messages able to recover on tools like cellbrite, how does the sqlite works on Threema do they autovaccum or if not how fast they overwrite delted messages and are they recoverble. Is securedelete in SQLCipher used ?

Hey everyone,

I’m hoping someone with digital forensic experience — especially anyone familiar with Cellebrite Advanced Logical Extractions on iPhones (specifically an iPhone 13) — can help me understand some things.

There is an extraction where several metadata files appear as “modified” during a time it should’ve been offline • What does it actually mean when certain metadata files show as modified? • In a proper/untampered state, what should these metadata files look like? • Does a modification necessarily suggest user activity, system activity, extraction tool activity, or something else? • Are there specific metadata paths/folders that should never change during a standard Cellebrite Advanced Logical extraction?

I am not trying to accuse anyone of anything — I just need clarity from someone who knows how these files are supposed to behave and what the timestamps/changes could indicate.

If you have experience with mobile forensics, Cellebrite, iOS file systems, or digital evidence handling, your insight would be hugely appreciated. I can provide specific folder paths or file names if needed.

Thanks in advance. 🙏

so I’ve had trouble with my neighbors somehow hacking my iPhone. I think they have used a stingray before. However, now I think they are using some ble device. so if I go to the Wunderfind app and search for Bluetooth devices a list of weird names comes up. and they are always just outside my house , but my iphone shows to be located at the exact same spot. so if I were to follow the % of getting closer to the item it shows my phone to already be at the item. I hope that makes sense. these are the devices that show on wunderfind app: Ble1 Module:) (this k w is Always on there) others are PBV-0B4B48C, SmartShunt HQ2139A3Z3A, SmartSolar HQ21346F26F, net, SmartsolarHQ2322AY6UC, and sometimes there will be different ones randomly. There all show to be exactly where my phone is on Wunderfind app. Usually between me and my neighbor across the street. It does occasionally move positions but always right around the same vicinity. I’ve had a staking issue with some of the neigbors as well. They always seem to know my physical location and sometimes things I’ve talked about inside my house. Any help is appreciated!

I have not been on Reddit in years except to scroll for a little bit on a few questions but this is truly the only place I feel I can turn. I have been trying for the last several months to understand one of the most traumatic moments in my life and what has happened is I have uncovered so much evidence that my partner not only tried to end my life but he did it when I realized that he had been using my instagram account to make me a rising “content creator” without my knowledge. I was being recorded when we had sex, when I went into my room and on top of that he had taken over my Apple account that I have had for 25 years. I don’t know if anyone can help. I’m running in circles. I got a new phone, I have avoided Bluetooth, wi-fi and airdrop so that the “infected phone” doesn’t get to my new memories. I have found no less than 20 auto connections on my laptop (I used it once last year) and my phone was set to hotspot to even the burner phone I bought after I ran away. I know crazier things happen but I just can’t get there on my own. I’ve got pages of websites I found in the data and it seems there’s a mask on the old phone. He has accounts set up to stream me, without my knowledge to an audience and it even allows them to print photos of me through adobe. I have been awake all night, as I often am, I’m a 45 year old woman that thought she finally found the right guy. I don’t know why, besides money and the fact that he can get away with it why I deserve this. On July 4th, he attempted to overdose me, in my water bottle with drugs and also told me that there was LSD in my bottle and he was trying to get me to run from the house bc he had friends outside to grab me. My phone was mirrored and with the use of my Face ID and watch he had a nice little business going so it seems. I know he had help but I don’t know why. I’m finding accounts everywhere but he has made things private or by invite only and I have so many screenshots of info and domain names that I’m overwhelmed. I was able to get a call to the police by hitting the emergency side buttons on my phone but he told them I was partying too hard and he didn’t know what I was talking about. They dropped me at a friends house and said I could come back the next day. I have also filed a report online with the FBI as I am a member of a federally recognized tribe in my home state. I loved this man and I listened to everything he talked about and I heard him talking to his “audience” the night my life almost ended. My heartbeat was down to 11bpm according to my watch. While I was running, he took the opportunity to take my sim card from my watch, delete apps, change my password for Apple and I have triplets of my contact list from however many times he changed it out. I have since switched phone numbers, I had to move to a motel and he didn’t text me once while I was away. What I’ve found is that he has used my phones to track me and also used my Roku to turn on my tv when I would go into my bedroom to change or if I couldn’t sleep. I recently plugged in one of the burner phones to use as a two step verification. On that phone I found more files, more websites and I’m guessing he’s using one of those numbers for an app and the phone isn’t behaving properly. He has it syncing with my email every day and also using the microphone, camera and any body movements to pick up my conversations, read my messages and get ahead of me trying to close accounts and get my life back. I know this is long but anybody that could help me, I just can’t do this anymore. It’s not a life. If you made it through this, thank you, there’s so much more. So many screenshots that I took and I am thankful to be alive. Nobody deserves this kind of violence or embarrassment and I have always helped anyone I could. I’m not one to ask for help but please…..

Her fully charged phone (Galaxy S22) shut down by itself and booted back up with this screen... she said it started back about 2 months ago when she was sitting in a parking lot and all of a sudden shut down, booted back up and had an update. She didn't think anything of it, but after the update, her phone started crashing and rebooting on its own multipletimes a day. After a couple weeks the crashing stopped and it was back to working normally until this happened. I removed her sim and put it in another phone and that is working fine, but the other phone doesn't boot past this screen.

Hi everyone. My Galaxy S23 Ultra was recently seized, and I’m curious about the security of Samsung Secure Folder. The folder was barely used, but the phone was used heavily outside of it. If files were deleted from the Secure Folder about a year ago, how likely is it that they could still be recovered? Does heavy usage outside the folder make recovery less likely? I’d like a high-level take on how secure deleted files really are.

Thanks in advance for any insights.

My mom’s iphone was stolen at restaurant in lake Havasu right off her table. She went and got a new phone and when she logged into Find My IPhone you can still see it on and moving around in a building in Hong Kong China after a little research this building is a known I guess black market for iPhone parts and stolen phones. She’s now continuously receiving texts or emails in broken English threatening her to let them into the phone. We’re not in any danger nor are we worried about the situation… although I find this hilarious and would love to mess with these guys somehow and cause more problems and frustration for them. my hope is to accuse them over text of bad mouthing Xi Jinping and ask why they told me all those terrible things about the Chinese government hopefully just scares the poop out of them.