There are so many different Apps out that trying to stay on top of the trends is an impossible job. Many times, Paraben checks into Apps based on requests and demands associated with specific cases. That is true of the App TextNow. It came to our attention because of a case demand, so some digging needed to happen to see what was available from the App.
The App itself is a universal calling App that will work on all smartphone platforms as well as desktop systems. It creates one App to rule them all with being able to funnel other data into it. Some of the unique features that make it great, if you are looking to hide, is that you get to pick a universal phone number that anyone with the App or without can call you on. Sadly, the criminal element has taken notice and this App has now started to appear in cases.
Many times, those doing the analysis want the App data to jump out immediately, but as App trends go up and down, knowing how to look for the data is crucial. TextNow was not part of the parsed Apps in E3, but that doesn’t mean there is not a forensic nugget for you to find. If you do a search for “textnow” after your acquisition (or you can do a sorted file search in the Database category), you will start to see data leading you to the main storage for TextNow data.
Once you get a hit, you are going to see some good examples of why you love to have a SQLite parser in your tool. It allows you to virtually support almost all the Apps out there with just some slight changes in your process. Most Apps keep the name of the App in the database associated with the data. This is why we searched for “textnow” and it led us to the following:
SCREEN SHOT of Tree view in E3
From this data we know we can see the rough details of what the app was doing with the communication, and then find what our potential suspect was using the App for.
SCREEN SHOT of DATA
Off of a quick look we see that text messages, calls, etc. are all stored and ready to be marked for review as potential evidence. Remember that a simple search and review with a SQLite Viewer, like what is built into E3, can save you a lot of time when it comes to parsing some of the unique Apps out there.