Green meets Blue: A brief RCS forensic excursion

1. WHAT RCS is? (Rich Communication Services)
2. What can it do?
3. WHO uses RCS and, if so, HOW?
4. And, above all, where can I find forensic evidence of this?

Read the full blog here: MSAB BLOG.GreenMeetsBlueABriefRCSforensicexcursion

All delivered in what I hope is a concise and accessible way, while still bringing in the right level of expertise where it matters. Think of it as too detailed for a TikTok, but not quite long enough for a podcast.

RCS is a modern messaging standard that was introduced to replace SMS and MMS and bring chat app functionality directly into the normal messaging app on mobile phones. The communication standard was developed by the GSM Association (GSMA) for IP-based messaging on mobile phones. It is therefore binding for every device that is active on the GSM network and always uses the same standard, ensuring cross-platform communication. However, it is not mandatory for a provider to offer RCS.

Important functions

Sending high-resolution photos, videos, files and, in some cases, GIFs directly in the messaging app.
Typing indicator (“someone is typing…”), read/receipt confirmations, longer text lengths and improved group chats with renaming and leaving groups.
Use of mobile data or Wi-Fi instead of the traditional SMS signaling network.

Security and encryption
RCS is fundamentally IP-based; many implementations encrypt messages at least during transmission.
Provided that both participants are using compatible RCS implementations that support end-to-end encryption, 1:1 chats can be end-to-end encrypted.

Understanding the differences: SMS, iMessage and RCS

Before we address the forensic challenges, it is important to distinguish differences between these messaging protocols:

SMS
iMessage
RCS

This traditional text messaging standard is limited to 160-character text messages, offers no encryption and only supports basic metadata.
Apple’s own messaging service uses end-to-end encryption and synchronizes messages across devices. Messages are stored in iCloud backups.
Unlike SMS, RCS works online and supports modern communication features like iMessage and other chat applications.

What if my conversation partner does not support RCS, or who supports RCS anyway?Two factors are important here: the mobile operating system and the network operator.

While the former is relatively easy and straightforward to answer, all modern Android smartphones (from Android 6 with Google Messages onwards) and newer iPhones with iOS 18 or higher currently support RCS. The second factor, network operator support, is somewhat more complicated. Although coverage is improving, it has not yet quite caught up with SMS. Many of the major providers worldwide, such as Telekom, Vodafone, Orange, AT&T, T-Mobile, Verizon and others, support RCS as standard at no extra charge. Whether Android or Apple iOS, RCS messages are always stored and sent in the normal standard app (Messages, for example). No extra RCS app is required.

Read the full blog here: MSAB BLOG.GreenMeetsBlueABriefRCSforensicexcursion