-
What are the files of interest in the first place? 
Extraction of applications,photos,passwords – iOS forensics – There are several directories that one can find for investigation purposes inside an iOS. It is irrespective of whatever the device model is. The structure of directories is common among all iOS devices. The layout utilized for it is a UNIX layout. It is very vital to mention that different file formats exist in this case. Thus, there are some files of format XML, binary data, or SQL databases.
Alright, so how are we going to investigate such files without getting to know their actual location on the device? Initially, data of the default application gets stored inside the following path: private/var/mobile/Library folder. In other words, data of apps like Address Book, Mail, Calendar, Maps, Notes, YouTube, Safari, Texting, Weather and Voicemail applications. On the other hand, some other apps like NFL 2012, Shazam or AroundMe which essentially get downloaded from iTunes have their data stored in the following path: private/var/mobile/Applications.
-
Downloaded applications from iTunes in private/var/mobile/Applications 
The folder: Mobile/Application is always in a dynamic status especially whenever a new application gets downloaded from iTunes. When this happens, basically a new directory gets automatically created inside this folder. Such a file contains all the embedded files that an application needs and originally comes. Also, a unique identifier of 32-character alphanumeric values. This identifier will use by any iOS devices produced by Apple after that.
An example of such an identifier could be something like“GA07A3WW- 0E39-33OJ-B947-9CAA16688G22”. When dealing with this application iOS devices is perceive as an id which is consistent and used it. By default, there are some subfolders contained by an application:
- Documents folder: this has all the files which are relevant to an application.
- Temp folder: any files which are runtime and temporary reside there.
- Library folder: any data which is cached or preferences are included in this folder.
There are also some other files which are commonly found in an application folder in an iOS device. Such records are like info.plist, resourcerules.plist and applestores.db. However, configuration files, plist files, and XML data could be found varying and different according to the application itself. It also happens that some vitally essential data for an investigation process could be existent inside such folders. Such include cookies, usernames, and passwords.
-
Photos inside private/var/mobile/media/DCIM
All photos could be found in the media/DCIM folder. These are photos either taken via the phone itself or synced from another device. All images will have timestamp metadata. If a picture is received through the camera of the device itself, then it will reside inside a folder named 100APPLE. It will have a name which is order sequentially. It is according to when the photo was taken in comparison to the others.
To elaborate on this point, naming such photos will begin with “IMG_0001” and then this number will get incremented by one each time a new picture takes no matter how many images got removed in the way through. Taking into consideration, it shall conclude that any missing numbers throughout the used range will indicate that its associated photo is deleting for some reason.
Sometimes it is essential and most importantly exciting to get to know what programs or applications were installed on the machine before it becomes on its current state at the time of forensics. It could be identified through the folder of DCIM/999Apple. Inside this folder, all taken screenshots will be found, which will eventually help with the investigation process. Navigating through these photos will show whether a banned application suspected to have been running on the device was installed or not.
-
Keystrokes inside /private/var/mobile/Library/Keyboard 
A text file named dynamic-text.dat is considered a dynamic dictionary for an iOS device. It is one of the most important directories to investigate through because every written word by the user gets stored in this dictionary at the time it gets typed. Applications like Notes, Safari, Messages, Facebook will have any typed words inside them get entered into this dynamic dictionary. In fact, any applications which are open for a text input get their text data stored in this dynamic dictionary.
The rationale behind such dictionary lies in aiding a user with the typing process. On the other hand, this aspect is perceived as a source of a precious information because common words can come to be known and hence become a keyword for searching.
The downside of this dictionary is that it does not include a timestamp metadata of its reserved words. Accordingly, the time in which a word was typed cannot be identified through this dynamic dictionary.
There is an SQLite database named UserDictionary.sqlite in which all manual auto-corrections get stored. The importance of such database from the perspective of an examiner is that any keywords could be identified whether they are technical ones, special ones, of the Standard English language, or even any acronyms which could become all of the great vitality to the investigation process.
-
Passwords inside /private/var/Keychains 
The keychain of Apple to manage passwords is the one that is mostly in use when it comes to passwords of iOS applications. A database file called keychain-2.db is utilized for the sake of having different accounts and passwords which used to be utilized on the device previously. The are several tables used for saving this information. They include cert, genp, inet, keys, sqlite_sequence, and tversion.
Inside this database, there is a great deal of valuable data that could be found there such as Voicemail passwords, wireless access point key phrases and device login passcodes. While some of these passwords may be stored in an encrypted format, some others could be found in an understandable form. Nevertheless, for those encrypted ones, a password cracker utility could be seen in this case. For instance, an examiner may depend on Elcomsoft’s iPhone Password Breaker, where the extracted keychain file should be given to get such files decrypted.
Try Certified Ethical Hacker for FREE!!!– https://infosecaddicts.com/course/certified-ethical-hacker-v10/
Resources
https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092
http://resources.infosecinstitute.com/ios-forensics/
$0
Join the infosec family! Your journey starts here. The free tier gives you limited access to our training materials.
$49
This is the second tier that includes limited access to our training materials and to our exclusive lab.
$69
This third tier gives you all the luxuries of the Free use and more. You have access to self-paced classes.
$89
This last tier gives you the Free, Social and Problem use for just $89 a month. Plus you will save $29!!!
