SecureArtisan

My Road to Digital Forensics Excellence

Blackberry IPD Files

Posted by Paul Bobby on May 6, 2010

I have added a new enscript to the “My Files” page that can partially parse a Blackberry IPD file. The great tool, ABC Amber Blackberry Converter, does a fantastic job, and for the price, can’t be beat. But I found the format of the IPD file at the Blackberry.com website, so why not give it a go in Enscript?

It’s an interesting structure in that the entire file must be processed before any data can be retrieved. Each component of the IPD file is called a database. For example, SMS text messages are stored in the “SMS Messages” database, but there is no pointer to the start of the data, and so the initial list of databases must be parsed, followed by each individual database until you get to the start of the SMS Messages. Blackberry indicates that they are okay with this inefficient processing during both creation and reading of the file since it is designed as a backup method only and not a real-time data store.

The enscript, in its current form, will only parse the contents of the SMS Messages database. There are some unknowns which I have yet to figure out, namely:

1. How do I get the timestamp information for the SMS Message?
2. What are all the Field Types?

I believe the timestamp is encoded somehow in one of the Fields of the database.

Advertisements

3 Responses to “Blackberry IPD Files”

  1. Hey Paul, this is a great start. I’ll have to go digging through all my stuff. A few years back I wrote one that parsed a decent number of fields, but I think I left it incomplete after tiring of hashing out RIM’s annoying format. ๐Ÿ™‚ Maybe it would be a good time to pick it back up.

  2. Paul Bobby said

    Heh I wrote this one while waiting for a PO to complete for the purchase of ABC Amber Converter for Blackberry. Now that I have this awesome program, I’ve suddenly lost all motivation to continue adding to the enscript ๐Ÿ™‚

  3. It’s a pretty wonderful little app – still, some folks love seeing all the bits and pieces moving, and there’s merit in opening things up a little.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

 
%d bloggers like this: