Artifacts of an IOS device
- This important file is located inside the folder of the root application.
- Relevant information about the device of interest may be revealed from this critical file. Such information includes the name of the used Apple Account and the date when the iPhone device was primarily purchased by the user. The importance of such information may vary according to the case being investigated.
- One of the following files will appear in each directory of an application on the iOS device:
- AccountURLBagType: in a string format.
- CreditDisplayString: in a string format.
- AccountServiceTypes: in a Number format.
- DidFallbackToPassword: in a Boolean format.
- AccountStoreFront: in a string format
- AccountIsNewCustomer: in a Boolean format.
- AccountKind: in a Number format.
- AccountAvailableServiceTypes: in a Number format.
- AppleID: in a string format.
- AccountSocialEnabled: in a Boolean format.
- AccountSource: in a String format
- DSPersonID: in a Number format.
- PurchaseDate: in a string format.
- It’s essential to understand timestamps. That is to know the timing of a piece of evidence on the device.
- Most timestamps used in an iOS device are MAC absolute timestamps.
- To get such types of timestamps that are converted into an understandable format, we can use one of the commonly available sources online that perform such conversion.
- Another method that could get such MAC absolute time converted is to depend on the date command with a u switch on MAC. This will get the time turned into local time on the device or UTC.
- The most commonly used database format inside an iOS device is the SQLite database. It is used for the sake of getting most of the data that is stored and organized inside the device. In fact, most phone platforms rely heavily on the same SQLite databases for storing their data. Examples of such platforms are Windows Phone operating system which used to operate on Nokia smartphones in the past for instance.
- Data of Apple applications gets stored inside such SQLite databases. Data of any third-party applications could get stored inside the same sort of databases as well.
- For the sake of getting an SQLite database opened and investigated through, there has to be a tool used for this purpose. Fortunately, there exist several open source applications coming at a zero price to perform this task and make us grasp what is inside the database. In general, SQLite Database Browser is considered to be the best and mostly utilized application to display an SQLite database file. It comes with a command line utility and an interesting GUI as well.
- Property List Files:
- Formats of data inside an iOS device are mostly of .plist formats or as more formally referred to as Property List Files.
- What are the main kinds of data that could get stored inside such plist format files? Any configuration information, preferences, and settings have this file formats on the iOS devices.
- To get such file formats opened, you can choose between two methods. While you can just open them using any text editor, plist Editor is a must to use to get these files parsed.
Note that there is an excellent value in extracted configuration files from the forensics point of view. The reason for that lies in the variety of such files that could be of great importance when extracted. The following points will list the different files of these:
- Information of the device and account: the plist file inside: /private/var/root/Library/Lockdown/data_ark.plist has information about the device and the account holder of the device.
- Information about the account: the Sqlite database file inside: /private/var/mobile/Library/Accounts/Accounts3.sqlite has information about the used account. On the other hand, the plist file inside /private/var/mobile/Library/ DataAccess/AccountInformation.plist contains account’s information for that account which was responsible for setting up applications on the iOS device.
- Airplane Mode: the plist file located inside: /private/var/root/Library/Preferences/com.apple.preferences.network.plist. has in fact information about the state of the iOS device in the present period whether airplane mode is enabled for it or it is disabled.
- List of installed applications: the plist file inside /private/var/mobile/Library/Caches/com.apple.mobile.installation.plist has a complete list of all the applications which are installed on the iOS device. Also, a path to the files of each application is contained inside this plistfile as well. Mapping GUIDs to a specific application will be guided and undoubtedly aided by such valuable file.
AppStore settings: the plist file inside /private/var/mobile/Library/Preferences/com.apple.AppStore. plist contains the last search store, which could be a plus for identifying preferences of the iOS device user.
- Information of Configuration and Settings: the folder is having the following location of: /private/var/mobile/Library/preferences/ contains several plist files which have settings of Apple applications and configurations.
- Lockdown certificate Information: inside the folder of /private/var/root/Library/Lockdown/Pair_records/ there shall be existing all computers that are paired with the iOS device, and all the lockdown/pairing certificates as well.
- Information about the network: the plist file inside /private/ var/preferences/Systemconfiguration/com.apple.network.identification.plist has some cached information about Internet Protocol (IP) networking such as devices like routers or network addressed and servers that were utilized by the iOS device in the past. Timestamps of such information are all available inside this exciting file.
- Notification log: the plist file inside/private/var/mobile/Library/BullitenBoard/ClearedSections.plist has a log of the notifications which were displayed inside the iOS device. This also extends to any cleared notifications of the device.
Passwords: from iOS 7 till iOS 10, the following path to the mentioned database had the password contained and saved in there but definitely in an encrypted format yet it could also be cracked: /private/var/keychains/Keychain-2.db
- Information about the SIM card: inside the plist file which is located in: /private/var/wireless/Library/Preferences/com.apple.commcenter.plist there resides several important data about the most recently used SIM card. In fact, ICCID and IMSI of the SIM are included in this plist file.
- Springboard: the order in which applications are displayed inside each screen of the iOS device is contained inside the plist file located in the following path: /private/var/mobile/Library/Preferences/com.apple.springboard.plist
- System Logs: the folder where all the logs are contained of every activity performed on the iOS device is located inside: /private/var/logs/
- Wi-Fi Networks: the plist file inside /private/var/preferences/ SystemConfiguration/com.apple.wifi.plist has all the configured and familiar Wi-Fi Networks to the iOS device. Each of such Wi-Fi network has its timestamp which essentially indicates the timing of the connection to such network and some other important information could be gathered from this plist file as well.