A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | |
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
1 | ARTIFACT | LABELs | PATH | NOTE | |||||||||||||||||
2 | Account and Device information | user, device, plist | /private/var/root/Library/Lockdown/data_ark.plist | It contains various information about the device and its account holder. | |||||||||||||||||
3 | Accounts information | user, db | /private/var/mobile/Library/Accounts/Accounts3.sqlite | Account information | |||||||||||||||||
4 | Accounts information | user, | /private/var/mobile/Library/DataAccess | Account information used to setup apps | |||||||||||||||||
5 | Accounts Settings | plist | /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist | It contains a list of synchronized mail accounts with usernames, host names, and persistent UUIDs. | |||||||||||||||||
6 | Address Book | user, contacts | /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb | address book contact information | |||||||||||||||||
7 | Address Book Images | user, contacts | /private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedb | pictures linked to address book contacts | |||||||||||||||||
8 | Airplane mode | system, plist, net | /private/var/root/Library/Preferences/com.apple.preferences.network.plist | Specifies whether airplane mode is presently enabled on the device. | |||||||||||||||||
9 | Application installed list | system, plist | /private/var/mobile/Library/Caches/com.apple.mobile.installation.plist | It contains a list of all installed applications on the device, and the file paths to each application. Useful to map applica*on GUIDs to specific apps | |||||||||||||||||
10 | Applications' folder | /private/var/mobile/Applications | Application folders | ||||||||||||||||||
11 | AppStore Settings | plist | /private/var/mobile/Library/Preferences/com.apple.AppStore.plist | It contains last store search | |||||||||||||||||
12 | Auto-correct dictionary | /private/var/mobile/Library/Keyboard/UserDictionary.sqlite | User created auto-correct dictionary | ||||||||||||||||||
13 | Calendar | /private/var/mobile/Library/Calendar/Calendar.sqlitedb | Calendar events | ||||||||||||||||||
14 | Calendar | /private/var/mobile/Library/Calendar/Extras.db | Calendar extras | ||||||||||||||||||
15 | Call History / Logs | /private/var/wireless/Library/CallHistory/call_history.db | |||||||||||||||||||
16 | Clipboard | /private/var/mobile/Library/Caches/com.apple.UIKit.pboard/pasteboard | It contains a cached copy of the data stored on the device’s clipboard. | ||||||||||||||||||
17 | Configuration information / Settings | plist | /private/var/mobile/Library/Preferences/ | ||||||||||||||||||
18 | Consolidated GPS cache | system, user, location | /private/var/root/Caches/locationd/consolidated.db | The WifiLocation and CellLocation tables contain information cached locally by the device and include WiFi access points and cellular towers that have come within range of the device at a given time, and include a horizontal accuracy (in meters), believed to be a guestimate at the distance from the device. | |||||||||||||||||
19 | Core Location | user, location, plist | /private/var/root/Library/Caches/locationd/cache.plist | The Core Location cache contains cached information about the last time the GPS was used on the device. The timestamp used in this file is created as the time interval from January 1, 2001. | |||||||||||||||||
20 | Email attachments | ||||||||||||||||||||
21 | Email database | /private/var/mobile/Library/Mail/Protected Index | This file contains information about messages stored locally, including sent messages and the trash can. It contains message information and message content. Although it has no extension, it's a sqlite database | ||||||||||||||||||
22 | Email information | /private/var/mobile/Library/Mail/Envelope Index | contains a list of mailboxes and metadata | ||||||||||||||||||
23 | FaceTime | plist | /private/var/mobile/Library/Preferences/com.apple.conference.history.plist | It contains a list of numbers that have conferenced using FaceTime | |||||||||||||||||
24 | Maps | user, location, db | /private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedb | Image data of previously displayed map tiles. Each record contains an X,Y coordinate on a virtual plane at a given zoom level, and a binary data field containing the actual image data, stored in PNG-formatted images | |||||||||||||||||
25 | Maps last query | user, location, plist | /private/var/mobile/Library/Preferences/com.apple.Maps.plist | It contains the last longitude and latitude coordinates viewed in the Google Maps application, and the last search query made. | |||||||||||||||||
26 | Maps lookup cache | user, location, plist | /private/var/mobile/Library/Maps/History.plist | it contains addresses, longitude and latitude, and other information about lookups performed. | |||||||||||||||||
27 | " | /private/var/mobile/Library/Maps/History.mapsdata | " | ||||||||||||||||||
28 | " | /private/var/mobile/Library/Maps/Geohistory.mapsdata | " + iOS 8 | ||||||||||||||||||
29 | iTunes | /private/var/mobile/Media/iTunes_Control/Music/ | It contains the music synched withthe device | ||||||||||||||||||
30 | Keystrokes / Keyboard Cache | /private/var/mobile/Library/Keyboard/dynamic-text.dat | |||||||||||||||||||
31 | Location services, apps that make use of | system, location, plist, app | /var/mobile/Library/Preferences/com.apple.locationd.plist | ||||||||||||||||||
32 | Lockdown certificate info | /private/var/root/Library/Lockdown/pair_records/ | It contains information about the lockdown/pairing certificates and also the computer it is paired with. | ||||||||||||||||||
33 | MMS Files | user, mms, db | /private/var/mobile/Library/SMS/Attachments/* | ||||||||||||||||||
34 | Network information | system, plist, net | /private/var/preferences/SystemConfiguration/com.apple.network.identification.plist | It contains cache of IP networking information like previous network addresses, router addresses, and name servers used. A timestamp for each network is also provided. | |||||||||||||||||
35 | Notes | /private/var/mobile/Library/Notes/notes.sqlite | |||||||||||||||||||
36 | Notification log | user, log, notification | /private/var/mobile/Library/BullitenBoard/ClearedSections.plist | Log of cleared notification | |||||||||||||||||
37 | Passwords | /private/var/Keychains | |||||||||||||||||||
38 | Phone numbers, dialed | user, plist | /private/var/mobile/Library/Preferences/com.apple.mobilephone.plist | It contains the DialerSavedNumber, which is the last phone number entered into the dialer and dialed, (regardless of whether it was dialed or not on iOS6). This remains even if the last call is then deleted from the call history list on the phone (and consequently on the database) | |||||||||||||||||
39 | Phone numbers, favorites | user, plist | /private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plist | It contains the phone numbers added to the phone favorites list | |||||||||||||||||
40 | Photo | user, img | /private/var/mobile/DCIM/ | User created photos via built-in camera and screenshots | |||||||||||||||||
41 | Photo | user, img | /private/var/mobile/Media/PhotoData/ | ||||||||||||||||||
42 | Photo | user, img | /private/var/mobile/Media/Photos/ | It contains photo albums synced from a desktop machine. | |||||||||||||||||
43 | Photo Metadata | /private/var/mobile/Library/PhotoData/Photos.sqlite | contains a manifest of photos stored in the device's photo album. The Photos table contains a list of photos and their path on the device, resolution, as well as a timestamp of when the photo was recorded or modified | ||||||||||||||||||
44 | Safari | /private/var/mobile/Library/Safari/* | Safary activitiy | ||||||||||||||||||
45 | Safari Bookmarks | user, browser, db | /private/var/mobile/Library/Safari/Bookmarks.db | ||||||||||||||||||
46 | Safari Bookmarks | user, browser, plist | /private/var/mobile/Library/Safari/Bookmarks.plist.anchor.plist | Timestamp identifying the last time Safari bookmarks were modified. | |||||||||||||||||
47 | Safari Cookies | user, browser | /private/var/mobile/Library/Cookies/Cookies.binarycookies | Web sites cookies | |||||||||||||||||
48 | Safari Screenshots | user, browser, img | /private/var/mobile/Library/Caches/Safari/ | Thumbnails directory containing screenshots of recently viewed web pages | |||||||||||||||||
49 | Safari Search cache | user, browser, plist | /private/var/mobile/Library/Caches/Safari/RecentSearches.plist | It contains the most recent searches entered into Safari’s search bar. | |||||||||||||||||
50 | Safari search history | user, browser, plist | /private/var/mobile/Library/Preferences/com.apple.mobilesafari.plist | It contains a list of recent searches made through Safari. This file does not get erased when the user deletes his browser cache or history. | |||||||||||||||||
51 | Safari Suspended State | user, browser, plist | /private/var/mobile/Library/Safari/SuspendState.plist | It contains the last state of Safari at the time the user pressed the Home button, the iPhone was powered off, or the browser crashed. It contains a list of windows and websites that were open so that the device can reopen them when the browser resumes, and represents a snapshot of the last web pages looked at by the target. | |||||||||||||||||
52 | Safari Thumbnails | user, browser, img | /private/var/mobile/Library/Caches/Safari/Thumbnails/ | A directory containing screenshots of the last active browser pages viewed with WebKit. | |||||||||||||||||
53 | Safari Web Cache | user, browser, db | /private/var/mobile/Library/Caches/com.apple.mobilesafari/Cache.db | It contains objects recently downloaded and cached in the Safari browser | |||||||||||||||||
54 | Safary History | user, browser, plist | /private/var/mobile/Library/Safari/History.plist | It contains the Safari web browser history since it was last cleared. | |||||||||||||||||
55 | Screenshots | /private/var/mobile/Library/Caches/Snapshots/ | It contains the screenshots of the most recent states of applications at the time they were suspended (typically by pressing the Home button or receiving a phone call). | ||||||||||||||||||
56 | SIM card info | plist | /private/var/wireless/Library/Preferences/com.apple.commcenter.plist | It contains the ICCID and IMSI of the SIM card last used in the device | |||||||||||||||||
57 | Siri | user, plist | /private/var/mobile/Library/Preferences/com.apple.assistant.plist | ||||||||||||||||||
58 | SMS Drafts | user, sms, plist | /private/var/mobile/Library/SMS/Drafts/* | Each draft is contained in its own folder as plist file, which is time stamped identifying when the message was typed and then abandoned | |||||||||||||||||
59 | SMS Messages | /private/var/mobile/Library/SMS/sms.db | |||||||||||||||||||
60 | SMS Spotlight cache | /private/var/mobile/Library/Spotlight/com.apple.MobileSMS/SMSSeaerchdb.sqlitedb | It contains a Spotlight cache of SMS messages, names, and phone numbers of contacts they are (or were) associated with. The Spotlight cache contains SMS messages long after they’ve been deleted from the SMS database. | ||||||||||||||||||
61 | SMS, iMessage and Facetime | /private/var/mobile/Library/Preferences/com.apple.imservice | |||||||||||||||||||
62 | Spotlight cache | /private/var/mobile/Library/Spotlight/ | |||||||||||||||||||
63 | Springboard | /var/mobile/Library/Preferences/com.apple.springboard.plist | It contains the order of applications in each screen | ||||||||||||||||||
64 | System Logs | system, log | /private/var/logs/ | Folder containing iOS system logs | |||||||||||||||||
65 | Thumbnails | user, img | /private/var/mobile/Library/Caches/Safari/Thumbnails/ | A directory containing screenshots of the last active browser pages viewed with WebKit. | |||||||||||||||||
66 | Voice Memos | /private/var/mobile/Media/Recordings/ | |||||||||||||||||||
67 | Voicemail | /private/var/mobile/Library/Voicemail/ | It contains the actual voicemail recordings stored as AMR codec audio files | ||||||||||||||||||
68 | Voicemail | /private/var/mobile/Library/Voicemail/voicemail.db | It contains information about each voicemail stored on the device, and includes the sender’s phone number and callback number, the timestamp, the message duration, the expiration date of the message, and the timestamp (if any) denoting when the message was moved to the trash | ||||||||||||||||||
69 | Wallpaper | /private/var/mobile/Library/SpringBoard/HomeBackground.cpbitmap | |||||||||||||||||||
70 | Wallpaper | /private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail.jpg | |||||||||||||||||||
71 | Wallpaper | /private/var/mobile/Library/SpringBoard/LockBackground.cpbitmap | |||||||||||||||||||
72 | Wallpaper | /private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail.jpg | |||||||||||||||||||
73 | Web Application Cache | /private/var/mobile/Library/Caches/com.apple.WebAppCache/ApplicationCache.db | It contains a database of cached objects associated with web apps. | ||||||||||||||||||
74 | Web Clips | user, plist | /private/var/mobile/Media/WebClips/* | It contains a list of web pages assigned as buttons on the device’s home screen, each stored in a separate directory. In each directory there will be an info.plist file containg the related information. | |||||||||||||||||
75 | Web Kit Storage | /private/var/mobile/Library/WebKit | It contains a LocalStorage directory with unique databases for each website. | ||||||||||||||||||
76 | Wi-Fi networks | system, plist, net, wifi | /private/var/preferences/SystemConfiguration/com.apple.wifi.plist | It contains the list of known wi-fi network and the timestamp of last joined | |||||||||||||||||
77 | YouTube | user, plist | /private/var/mobile/Library/Preferences/com.apple.youtube.plist | It contains a history of the recently viewed youtube videos | |||||||||||||||||
78 | |||||||||||||||||||||
79 | |||||||||||||||||||||
80 | |||||||||||||||||||||
81 | |||||||||||||||||||||
82 | |||||||||||||||||||||
83 | |||||||||||||||||||||
84 | |||||||||||||||||||||
85 | |||||||||||||||||||||
86 | |||||||||||||||||||||
87 | |||||||||||||||||||||
88 | |||||||||||||||||||||
89 | |||||||||||||||||||||
90 | |||||||||||||||||||||
91 | |||||||||||||||||||||
92 | |||||||||||||||||||||
93 | |||||||||||||||||||||
94 | |||||||||||||||||||||
95 | |||||||||||||||||||||
96 | |||||||||||||||||||||
97 | |||||||||||||||||||||
98 | |||||||||||||||||||||
99 | |||||||||||||||||||||
100 |