{"id":169,"date":"2015-11-09T08:04:46","date_gmt":"2015-11-09T08:04:46","guid":{"rendered":"https:\/\/www.acquireforensics.com\/blog\/?p=169"},"modified":"2025-05-27T10:55:08","modified_gmt":"2025-05-27T10:55:08","slug":"ios-artifacts-forensic-analysis","status":"publish","type":"post","link":"https:\/\/www.acquireforensics.com\/blog\/ios-artifacts-forensic-analysis.html","title":{"rendered":"Deep Insight Into iOS Forensic Analysis"},"content":{"rendered":"<p>With the emergence of Android, things have completely changed. No one will be up there without android systems. It has brought significant impact on Smartphone marketing and along with that also made changes in the iOS forensic artifacts area. Each day new changes are brought into Smartphones and emailing, tasks listing etc. have become possible in this platforms. Earlier, PC and laptops were used for surfing on web but, now this has become possible within the small Smartphones and tablets. Data can be transferred, communication with mail server is possible and much more.<\/p>\n<p>With Apple Operation System i.e. iOS design, records of the emails, chats, browsing history and much more are kept in manner. This has led to forensics as well and so, this session will be discussing on the iOS forensic analysis.<\/p>\n<h2><strong>iOS Artifacts Forensic<\/strong><\/h2>\n<p>iOS is the Operating System for mobile, deployed by Apple Inc. It is the OS of applications such as, iPhones, iPads and iPods. For the success of forensics, keen observation of data is very essentials. In iOS devices, you will come across some of the things listed below.<\/p>\n<ul>\n<li>Notes<\/li>\n<li>Calendars<\/li>\n<li>Photos<\/li>\n<li>Keystrokes<\/li>\n<li>iTunes<\/li>\n<li>Map<\/li>\n<li>Clock<\/li>\n<\/ul>\n<p>During iOS forensic analysis, some of the applications such as, Calendar, Notes, Text Messages, Photos etc. use <strong><a href=\"https:\/\/www.acquireforensics.com\/blog\/sqlite-database-structure.html\" target=\"_blank\" rel=\"noopener\">Sqlite database structure<\/a><\/strong> for storing and organizing the data.<\/p>\n<p>iOS is the structure common. The on all iOS devices structure corresponds to UNIX layout and the files are stored in text format, enabling an iOS artifacts forensics.<\/p>\n<p>Applications store the data by default in;<\/p>\n<p><em>private\/var\/mobile\/Library<\/em><\/p>\n<p><strong>Photos<\/strong><\/p>\n<p>Location is;<\/p>\n<p><em>private\/var\/mobile\/media\/DCIM<\/em><\/p>\n<p>In this location all the iOS forensic artifacts like photos taken will be stored. The pictures will have timestamp metadata and if the photos are seen within the 100APPLE folder then, it shows that they are taken from the device.<\/p>\n<p>Apart from the ability to take the photos, it facilitates taking screenshots. Users can find these files from DCIM\/999Apple folder.<\/p>\n<p><strong>Keystrokes<\/strong><\/p>\n<p>While conducting iOS forensic analysis \u201cKeystrokes\u201d are seen in;<\/p>\n<p>\/private\/var\/mobile\/Library\/Keybord<\/p>\n<p>Here, you will find the words typed during the usage of the device. The words typed while using Safari, Messages, Notes, Facebook etc. will be captured up. This will help the agents in finding out the words related with their cases.<\/p>\n<p><strong>Notes<\/strong><\/p>\n<p>The \u2018Notes\u2019 are located in \/private\/var\/mobile\/Library\/Notes.<\/p>\n<p>Investigators can collect the keyword and other evidence from here. This database consists of 9 tables and among them ZNote is the important one. In ZNote table, you can see ZTITLE that holds the title of note, CREATIONDATE and MODIFICATIONDATE. The ZCONTENT column contains the body of the note.<\/p>\n<p><strong>Call History<\/strong><\/p>\n<p>The \u2018Call History\u2019 file is the most important file in iOS forensic analysis that an investigator will look for since it reveals out many clues or evidence. The call_history.db file contains date of call, duration, phone number and the reference ID of contact. The flag field indicates incoming as well as outgoing; former one with number 4 and other number 5.<\/p>\n<p>Location: <em>\/private\/var\/Library\/CallHistory<\/em><\/p>\n<p><strong>Browser Cookies<\/strong><\/p>\n<p>Cookies give the information on the websites visited. These iOS forensic artifacts help the investigator to browse the sites that the suspect has visited.<\/p>\n<p>Located at;<\/p>\n<p><em>\/private\/var\/mobile\/Library<\/em><\/p>\n<p><strong>Text Messages <\/strong><\/p>\n<p>Located in;<\/p>\n<p><em>\/private\/var\/mobile<\/em><\/p>\n<p>Apart from the web browser history, agent can get good pieces of evidence from the text messages and SMS as well.<\/p>\n<p>iOS forensic analysis helps investigator to collect information on SMS from;<\/p>\n<p>\/private\/var\/mobile\/Library\/SMS<\/p>\n<p>sms.db file will be present which gives the detail of the current i.e. existing and the old conversation, even if it is deleted.<\/p>\n<p><strong>AddressBook<\/strong><\/p>\n<p>Address book stores the details of the owner and is located in;<\/p>\n<p><em>\/private\/var\/mobile\/Library\/AddressBook<\/em><\/p>\n<p>The data gets stored in AddressBook.sqlitedb file and the ABPerson table contained in the database file shows the details such as, first name, last name, job, birthday, nickname etc.<\/p>\n<blockquote><p>The <strong>AddressBook.sqlitedb<\/strong> file is a type of Sqlite file that can be viewed by using <strong><a href=\"http:\/\/www.acquireforensics.com\/products\/sqlite-forensic-explorer\/\" target=\"_blank\" rel=\"noopener\">Sqlite Forensics Viewer<\/a><\/strong>.<\/p>\n<p><a href=\"https:\/\/www.acquireforensics.com\/download\/SYS2S2V9P\/544\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone wp-image-179 size-full\" src=\"https:\/\/www.acquireforensics.com\/blog\/wp-content\/uploads\/2015\/11\/download.png\" alt=\"download\" width=\"192\" height=\"44\" \/><\/a><\/p><\/blockquote>\n<p>To acquire and analyze the ios forensic artifacts from the database, investigators have to depend on tools that will open the file. There are many tools available in the market that helps experts to perform iOS forensic analysis. Hope this information might have added up your knowledge and will be helpful for investigating.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>With the emergence of Android, things have completely changed. No one will be up there without android systems. It has brought significant impact on Smartphone marketing and along with that also made changes in the iOS forensic artifacts area. Each day new changes are brought into Smartphones and emailing, tasks listing etc. have become possible [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":171,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12],"tags":[],"class_list":["post-169","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-operating-system"],"_links":{"self":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/169","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/comments?post=169"}],"version-history":[{"count":1,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/169\/revisions"}],"predecessor-version":[{"id":602,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/posts\/169\/revisions\/602"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/media\/171"}],"wp:attachment":[{"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/media?parent=169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/categories?post=169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.acquireforensics.com\/blog\/wp-json\/wp\/v2\/tags?post=169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}