Getting Started with iOS Forensics

There are two types of timestamps that an iPhone use. While using the tools for forensics purpose, the examiner has to ensure that the tools convert the timestamp properly. If there is access to the raw SQLite files, then the timestamps can be manually verified.

Unix Timestamp: The epoch time of Unix gets started from 1st January 1970. The Unix Timestamp is the number of seconds that offsets the epoch.

Mac Absolute Time: The Mac epoch time starts from 1ST January 2001. There is a difference of 978, 307, 200 seconds between the Mac and Unix epoch.

For forensics of iOS device the logical acquisition of data is require which could reveal the Phone secrets. The data stored in iPhone, iPad & iPod is in SQLite format. SQLite is a database engine of SQL (Structured Query Language) that is an open source. It is transactional in nature and does not require any set-up, installation, configuration files, or administration. This server less database management system is a popular DB format on various mobile platforms.

Like other smart phones in the market, iPhone also makes heavy use of SQLite for storing its database like calendar, messages, notes, phone information etc. Moreover, third party applications that are installed on iOS (For example: Whatsapp, Skype) also use SQLite database to store their data.

The SQLite database is stored in single disk file which may or may not have file extension. Usually, you will find the database saved with .db or sqlitedb file extension but this can vary also vary (according to the application that uses the SQLite).

The address book will contain all personal contact information of the user, except for those from the third party application. This will get saved into the Home Domain file that will be available following location:

'private/var/mobile/library/ addressbook /addressbook.sqlitedb'

When the addressbook.sqlitedb file is further explored in a SQLite browser, three tables will give suitable information to the examiner:

• ABPerson: Details like name, notes, and organization gets saved into this table.
• ABMultiValue: The extended information from the ABPerson table like email address, phone numbers, Website URL etc. will be saved here. The ABMultiValue table uses a file named record_id that is linked with the row_id file of ABPerson table.
• ABMultiValueTable: The labels that will help to identify the information that is saved in the ABMultiValue table.

Received, Dialed, or Missed call details of iPhone gets saved into SQLite database along with the metadata like date, time, day, call duration, etc. This information gets saved into WirelessDomain file at:

'private/var/wireless/Library/CallHistory/call_history.db'

In this file, details of only 100 calls will be stored (collaboratively received, dialed, and missed) and the older entries will be removed from the records. However, these records can still be recovered from the free SQLite space through manual hex examination.

In the call_history.db file, there will be a table named "call" that will have information about phone number of the other party, the duration for call (in seconds), the UNIX timestamp of when the conversation initiated, the mobile country code etc. This table will also has status flag that helps to identify the call type.

• Flag (16) - FaceTime call
• Flag (5) – Outgoing Call
• Flag (4) – Incoming Call
• Flag (8) – Blocked Call
• Flag (-1) – For Unknown Contact

The multimedia messages that are sent from or to the phone along with relation information like date, time, number of the remote party etc. From iOS 5, the iMessage data gets saved into the SMS database only. iMessage is a proprietary service by Apple that allows sending text, multimedia messages, audios, videos from one iOS device to another. This database gets saved into the Home Domain at:

'private/var/mobile/Library/SMS/call_history.db'

SMS Spotlight Cache

The SMS data of iOS is indexed in a database so that it can be quickly searched. This Spotlight is a search feature that is used for the entire device. The Spotlight Cache database gets saved into Home Domain at:

'private/var/mobile/Library/Spotlight/com.apple.MobileSMS/SMSSearchIndex.sqlite'.

In Safari browser, the user is allowed to bookmark important websites on machine. This database will be saved into Home Domain at:

'private/var/mobile/Library/Safari/Bookmarks.db'

While the recently downloaded and cached data gets saved at:

'private/var/mobile/Library/Caches/com.apple.mobilesafari/cache.db'.

The detailed information of photos stored in the photo album in iOS gets saved in SQLite database at:

'private/var/mobile/library/ addressbook /addressbook.sqlitedb'

The geolocation history of the device is saved in any of the following databases:

Private/var/root/Caches/location/ consolidated.db

Private/var/root/Caches/location/ cache_encryptedA.db

These database files are the part of Root Domain. The information about the cell towers that were close to device or the Wi-Fi networks that were available for connection will be saved in this files.

The email database of applications get saved into SQLite database in the Home Domain. The database is saved with no extension and is saved at:

'private/var/mobile/Library/Mail/Protected Index'

Note: The attachments will be saved at Mail directory.