iOS Forensics Artifacts v0.1
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

View only
 
ABCDEFGHIJKLMNOPQRSTU
1
ARTIFACTLABELsPATHNOTE
2
Account and Device informationuser, device, plist/private/var/root/Library/Lockdown/data_ark.plistIt contains various information about the device and its account holder.
3
Accounts informationuser, db/private/var/mobile/Library/Accounts/Accounts3.sqliteAccount information
4
Accounts informationuser, /private/var/mobile/Library/DataAccessAccount information used to setup apps
5
Accounts Settingsplist/private/var/mobile/Library/Preferences/com.apple.accountsettings.plistIt contains a list of synchronized mail accounts with usernames, host names, and persistent UUIDs.
6
Address Bookuser, contacts/private/var/mobile/Library/AddressBook/AddressBook.sqlitedbaddress book contact information
7
Address Book Imagesuser, contacts/private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedbpictures linked to address book contacts
8
Airplane modesystem, plist, net/private/var/root/Library/Preferences/com.apple.preferences.network.plistSpecifies whether airplane mode is presently enabled on the device.
9
Application installed listsystem, plist/private/var/mobile/Library/Caches/com.apple.mobile.installation.plistIt contains a list of all installed applications on the device, and the file paths to each application. Useful to map applica*on GUIDs to specific apps
10
Applications' folder/private/var/mobile/ApplicationsApplication folders
11
AppStore Settingsplist/private/var/mobile/Library/Preferences/com.apple.AppStore.plistIt contains last store search
12
Auto-correct dictionary/private/var/mobile/Library/Keyboard/UserDictionary.sqliteUser created auto-correct dictionary
13
Calendar/private/var/mobile/Library/Calendar/Calendar.sqlitedbCalendar events
14
Calendar/private/var/mobile/Library/Calendar/Extras.dbCalendar extras
15
Call History / Logs/private/var/wireless/Library/CallHistory/call_history.db
16
Clipboard/private/var/mobile/Library/Caches/com.apple.UIKit.pboard/pasteboardIt contains a cached copy of the data stored on the device’s clipboard.
17
Configuration information / Settingsplist/private/var/mobile/Library/Preferences/
18
Consolidated GPS cachesystem, user, location/private/var/root/Caches/locationd/consolidated.dbThe WifiLocation and CellLocation tables contain information cached locally by the device and include WiFi access points and cellular towers that have come within range of the device at a given time, and include a horizontal accuracy (in meters), believed to be a guestimate at the distance from the device.
19
Core Locationuser, location, plist/private/var/root/Library/Caches/locationd/cache.plistThe Core Location cache contains cached information about the last time the GPS was used on the device. The timestamp used in this file is created as the time interval from January 1, 2001.
20
Email attachments
21
Email database/private/var/mobile/Library/Mail/Protected IndexThis file contains information about messages stored locally, including sent messages and the trash can. It contains message information and message content. Although it has no extension, it's a sqlite database
22
Email information/private/var/mobile/Library/Mail/Envelope Indexcontains a list of mailboxes and metadata
23
FaceTimeplist/private/var/mobile/Library/Preferences/com.apple.conference.history.plistIt contains a list of numbers that have conferenced using FaceTime
24
Mapsuser, location, db/private/var/mobile/Library/Caches/MapTiles/MapTiles.sqlitedbImage data of previously displayed map tiles. Each record contains an X,Y coordinate on a virtual plane at a given zoom level, and a binary data field containing the actual image data, stored in PNG-formatted images
25
Maps last queryuser, location, plist/private/var/mobile/Library/Preferences/com.apple.Maps.plistIt contains the last longitude and latitude coordinates viewed in the Google Maps application, and the last search query made.
26
Maps lookup cacheuser, location, plist/private/var/mobile/Library/Maps/History.plistit contains addresses, longitude and latitude, and other information about lookups performed.
27
"/private/var/mobile/Library/Maps/History.mapsdata"
28
"/private/var/mobile/Library/Maps/Geohistory.mapsdata" + iOS 8
29
iTunes/private/var/mobile/Media/iTunes_Control/Music/It contains the music synched withthe device
30
Keystrokes / Keyboard Cache/private/var/mobile/Library/Keyboard/dynamic-text.dat
31
Location services, apps that make use ofsystem, location, plist, app/var/mobile/Library/Preferences/com.apple.locationd.plist
32
Lockdown certificate info/private/var/root/Library/Lockdown/pair_records/It contains information about the lockdown/pairing certificates and also the computer it is paired with.
33
MMS Filesuser, mms, db/private/var/mobile/Library/SMS/Attachments/*
34
Network informationsystem, plist, net/private/var/preferences/SystemConfiguration/com.apple.network.identification.plistIt contains cache of IP networking information like previous network addresses, router addresses, and name servers used. A timestamp for each network is also provided.
35
Notes/private/var/mobile/Library/Notes/notes.sqlite
36
Notification loguser, log, notification/private/var/mobile/Library/BullitenBoard/ClearedSections.plistLog of cleared notification
37
Passwords/private/var/Keychains
38
Phone numbers, dialeduser, plist/private/var/mobile/Library/Preferences/com.apple.mobilephone.plistIt contains the DialerSavedNumber, which is the last phone number entered into the dialer and dialed, (regardless of whether it was dialed or not on iOS6). This remains even if the last call is then deleted from the call history list on the phone (and consequently on the database)
39
Phone numbers, favoritesuser, plist/private/var/mobile/Library/Preferences/com.apple.mobilephone.speeddial.plistIt contains the phone numbers added to the phone favorites list
40
Photouser, img/private/var/mobile/DCIM/User created photos via built-in camera and screenshots
41
Photouser, img/private/var/mobile/Media/PhotoData/
42
Photouser, img/private/var/mobile/Media/Photos/It contains photo albums synced from a desktop machine.
43
Photo Metadata/private/var/mobile/Library/PhotoData/Photos.sqlitecontains a manifest of photos stored in the device's photo album. The Photos table contains a list of photos and their path on the device, resolution, as well as a timestamp of when the photo was recorded or modified
44
Safari/private/var/mobile/Library/Safari/*Safary activitiy
45
Safari Bookmarksuser, browser, db/private/var/mobile/Library/Safari/Bookmarks.db
46
Safari Bookmarksuser, browser, plist/private/var/mobile/Library/Safari/Bookmarks.plist.anchor.plistTimestamp identifying the last time Safari bookmarks were modified.
47
Safari Cookiesuser, browser/private/var/mobile/Library/Cookies/Cookies.binarycookiesWeb sites cookies
48
Safari Screenshotsuser, browser, img/private/var/mobile/Library/Caches/Safari/Thumbnails directory containing screenshots of recently viewed web pages
49
Safari Search cacheuser, browser, plist/private/var/mobile/Library/Caches/Safari/RecentSearches.plistIt contains the most recent searches entered into Safari’s search bar.
50
Safari search historyuser, browser, plist/private/var/mobile/Library/Preferences/com.apple.mobilesafari.plistIt contains a list of recent searches made through Safari. This file does not get erased when the user deletes his browser cache or history.
51
Safari Suspended Stateuser, browser, plist/private/var/mobile/Library/Safari/SuspendState.plistIt contains the last state of Safari at the time the user pressed the Home button, the iPhone was powered off, or the browser crashed. It contains a list of windows and websites that were open so that the device can reopen them when the browser resumes, and represents a snapshot of the last web pages looked at by the target.
52
Safari Thumbnailsuser, browser, img/private/var/mobile/Library/Caches/Safari/Thumbnails/A directory containing screenshots of the last active browser pages viewed with WebKit.
53
Safari Web Cacheuser, browser, db/private/var/mobile/Library/Caches/com.apple.mobilesafari/Cache.dbIt contains objects recently downloaded and cached in the Safari browser
54
Safary Historyuser, browser, plist/private/var/mobile/Library/Safari/History.plistIt contains the Safari web browser history since it was last cleared.
55
Screenshots/private/var/mobile/Library/Caches/Snapshots/It contains the screenshots of the most recent states of applications at the time they were suspended (typically by pressing the Home button or receiving a phone call).
56
SIM card infoplist/private/var/wireless/Library/Preferences/com.apple.commcenter.plistIt contains the ICCID and IMSI of the SIM card last used in the device
57
Siriuser, plist/private/var/mobile/Library/Preferences/com.apple.assistant.plist
58
SMS Draftsuser, sms, plist/private/var/mobile/Library/SMS/Drafts/*Each draft is contained in its own folder as plist file, which is time stamped identifying when the message was typed and then abandoned
59
SMS Messages/private/var/mobile/Library/SMS/sms.db
60
SMS Spotlight cache/private/var/mobile/Library/Spotlight/com.apple.MobileSMS/SMSSeaerchdb.sqlitedbIt contains a Spotlight cache of SMS messages, names, and phone numbers of contacts they are (or were) associated with. The Spotlight cache contains SMS messages long after they’ve been deleted from the SMS database.
61
SMS, iMessage and Facetime/private/var/mobile/Library/Preferences/com.apple.imservice
62
Spotlight cache/private/var/mobile/Library/Spotlight/
63
Springboard/var/mobile/Library/Preferences/com.apple.springboard.plistIt contains the order of applications in each screen
64
System Logssystem, log/private/var/logs/Folder containing iOS system logs
65
Thumbnailsuser, img/private/var/mobile/Library/Caches/Safari/Thumbnails/A directory containing screenshots of the last active browser pages viewed with WebKit.
66
Voice Memos/private/var/mobile/Media/Recordings/
67
Voicemail/private/var/mobile/Library/Voicemail/It contains the actual voicemail recordings stored as AMR codec audio files
68
Voicemail/private/var/mobile/Library/Voicemail/voicemail.dbIt contains information about each voicemail stored on the device, and includes the sender’s phone number and callback number, the timestamp, the message duration, the expiration date of the message, and the timestamp (if any) denoting when the message was moved to the trash
69
Wallpaper/private/var/mobile/Library/SpringBoard/HomeBackground.cpbitmap
70
Wallpaper/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail.jpg
71
Wallpaper/private/var/mobile/Library/SpringBoard/LockBackground.cpbitmap
72
Wallpaper/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail.jpg
73
Web Application Cache/private/var/mobile/Library/Caches/com.apple.WebAppCache/ApplicationCache.dbIt contains a database of cached objects associated with web apps.
74
Web Clipsuser, plist/private/var/mobile/Media/WebClips/*It contains a list of web pages assigned as buttons on the device’s home screen, each stored in a separate directory. In each directory there will be an info.plist file containg the related information.
75
Web Kit Storage/private/var/mobile/Library/WebKitIt contains a LocalStorage directory with unique databases for each website.
76
Wi-Fi networkssystem, plist, net, wifi/private/var/preferences/SystemConfiguration/com.apple.wifi.plistIt contains the list of known wi-fi network and the timestamp of last joined
77
YouTubeuser, plist/private/var/mobile/Library/Preferences/com.apple.youtube.plistIt contains a history of the recently viewed youtube videos
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
Loading...