On a Blackberry we found Windows Live Messenger was installed. In ./Blackberry FS/Root/feeds  we found numbered XML files. The filename seems to be constructud by the “acid” and a serial.

The version of Windows Live Messenger was 2.5.63. Its identifier was: net.rim.device.apps.internal.qm.msn
The structure of the XML files was:

<?xml version=”1.0″ encoding=”UTF-8″?>
<bf ver=”1.0.0″ >
<ac acid=”987654321″ adid=”9876543212345678900″ dn=”username” un=”1234432A” mcnt=”100″ >
<tfm mid=”1331676262011″ cti=”1331676262011″ txt=”text of some message” udn=”an other ame” uid=”-123456789″ puri=”-123456777″ turi=”null” >

To get as much data as possible, we created an Encase grepexpression to carve for messages:
<tfm mid=.[^>]{1,255}

The mid/cti times can be easily decoded using Dcode:

Blackberry Windows Live Messenger messages can be found. Sometimes even after the program is uninstalled.