iOS-Forensics-References icon indicating copy to clipboard operation
iOS-Forensics-References copied to clipboard

verified publisher icon RealityNet
→

Metadata

A curated list of iOS Forensics References, organized by folder with specific references (links to blog post, research paper, articles, and so on) for each interesting file

iOS Forensics References

Last update: April 17th 2023

DATA Partition (/private/var)

"/.fseventsd/" folder

  • /.fseventsd
    • Understanding MacOS File System Events with FSEventsParser
      • http://www.osdfcon.org/presentations/2017/Ibrahim-Understanding-MacOS-File-Ststem-Events-with-FSEvents-Parser.pdf
    • Mac OS X and iOS Forensics - Looking into the past with FSEvents
      • https://papers.put.as/papers/macosx/2017/summit_archive_1498158287.pdf
    • FSEvents Parser
      • https://github.com/dlcowen/FSEventsParser

"/containers/" folder

  • /containers/Data/System/"GUID"/Documents/storeSystem.db
  • /containers/Shared/SystemGroup/"GUID"/Library/BatteryLife/CurrentPowerlog.PLSQL
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice
      • http://www.mac4n6.com/blog/2018/12/16/on-the-third-day-of-apollo-my-true-love-gave-to-me-application-usage-to-determine-who-has-been-naughty-or-nice
    • On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to Prove You Listened to “All I Want for Christmas is You” Over and Over Since Before Thanksgiving
      • http://www.mac4n6.com/blog/2018/12/17/on-the-fourth-day-of-apollo-my-true-love-gave-to-me-media-analysis-to-prove-you-listened-to-all-i-want-for-christmas-is-you-over-and-over-since-before-thanksgiving
    • On the Sixth Day of APOLLO, My True Love Gave to Me – Blinky Things with Buttons – Device Status Analysis
      • http://www.mac4n6.com/blog/2018/12/19/on-the-sixth-day-of-apollo-my-true-love-gave-to-me-blinky-things-with-buttons-device-status-analysis
    • On the Seventh Day of APOLLO, My True Love Gave to Me – A Good Conversation – Analysis of Communications and Data Usage
      • http://www.mac4n6.com/blog/2018/12/20/on-the-seventh-day-of-apollo-my-true-love-gave-to-me-a-good-conversation-analysis-of-communications-and-data-usage
    • On the Eighth Day of APOLLO, My True Love Gave to Me – A Glorious Lightshow – Analysis of Device Connections
      • http://www.mac4n6.com/blog/2018/12/21/on-the-eighth-day-of-apollo-my-true-love-gave-to-me-a-glorious-lightshow-analysis-of-device-connections
    • On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map of My Recent Travels – iOS Location Analysis
      • http://www.mac4n6.com/blog/2018/12/23/on-the-tenth-day-of-apollo-my-true-love-gave-to-me-an-oddly-detailed-map-of-my-recent-travels-ios-location-analysis
    • APOLLO CurrentPowerLog Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_accessory_connection.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_airdrop.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_audio.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_deletion.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_info.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_nowplaying.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_app_usage_by_hour.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_assertion.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_audio_routing.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_awdl_states.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_backcamera_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_backlight_brightness.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_battery_level.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_battery_level_ui.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_bluetooth_device_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_button_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_camera_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_coalition_interval.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_device_lock_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_device_screen_autolock.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_device_telephony_activity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_device_telephony_registration.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_device_volume.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_display.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_display_brightness.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_frontcamera_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_ids_messages.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_incallservice.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_kernel_task_monitor.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_lightning_connector_status.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_lightnining_connector_status.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_location_client_status.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_location_tech_status.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_mobilebackup.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_network_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_paired_device_config.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_power_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_powernap.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_process_data_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_process_id.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_process_monitor_dynamic.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_push_message_received.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_rapport_received_message.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_springboard_aggregate_bulletins.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_springboard_aggregate_notifications.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_timezone.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_torch_state.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_video.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_video_cmfile.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_video_cmhls.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_video_vtsession.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_wallet_card.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_wallet_transaction.txt https://github.com/mac4n6/APOLLO/blob/master/modules/powerlog_wifi_properties.txt
    • Time Well Spent: Precision Timing, Monotonic Clocks, and the PowerLogs Database for iOS
      • https://www.forensicfocus.com/webinars/time-well-spent-precision-timing-monotonic-clocks-and-the-powerlogs-database-for-ios/
    • Oh no! I have a wiped iPhone, now what?
      • https://blog.digital-forensics.it/2021/05/oh-no-i-have-wiped-iphone-now-what.html
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /containers/Shared/SystemGroup/"GUID"/Library/Database/com.apple.MobileBluetooth.ledevices.other.db
    • Bluetooth – iOS
      • https://bitsplease4n6.wordpress.com/2020/12/17/bluetooth-ios/
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://dfir.pubpub.org/pub/frknihlg/release/1
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://cellebrite.com/en/how-to-use-ios-bluetooth-connections-to-solve-crimes-faster/
    • iLEAPP Bluetooth Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/bluetooth.py
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /containers/Shared/SystemGroup/"GUID"/Library/Database/com.apple.MobileBluetooth.ledevices.paired.db
    • Bluetooth – iOS
      • https://bitsplease4n6.wordpress.com/2020/12/17/bluetooth-ios/
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://dfir.pubpub.org/pub/frknihlg/release/1
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://cellebrite.com/en/how-to-use-ios-bluetooth-connections-to-solve-crimes-faster/
    • iLEAPP Bluetooth Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/bluetooth.py
    • EXTRACTING FORENSIC ARTIFACTS FROM APPLE CONTINUITY
      • https://smarterforensics.com/wp-content/uploads/2014/06/The-Cider-Press-DFIR_Summit2017.pdf
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /containers/Shared/SystemGroup/"GUID"/Library/Preferences/com.apple.MobileBluetooth.devices.plist
    • Bluetooth – iOS
      • https://bitsplease4n6.wordpress.com/2020/12/17/bluetooth-ios/
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://dfir.pubpub.org/pub/frknihlg/release/1
    • How to Use iOS Bluetooth Connections to Solve Crimes Faster
      • https://cellebrite.com/en/how-to-use-ios-bluetooth-connections-to-solve-crimes-faster/
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Cellebrite CTF 2020: Juan Mortyme
      • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iLEAPP Bluetooth Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/bluetooth.py
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083

"/db/" folder

  • /db/biome/
    • iOS 16 - Now You 'C' It, Now You Don't -- Breaking Down The Biomes Part 1
      • https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html
    • iOS 16 Breaking Down the Biomes Part 2 - AppInstalls, AppLaunch, & AppIntents
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-2.html
    • iOS 16 - Breaking Down the Biomes (Part 3) - Keeping up with CarPlay
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-3.html
    • iOS 16 - Breaking Down the Biomes (Part 4) - Surfin' with Safari
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-4.html
    • iOS 16 - Breaking Down the Biomes Part 5 -- "Hey Siri, find me some more data..."
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-5-hey.html
    • Bringing it Back With Biome Data
      • https://www.magnetforensics.com/blog/bringing-it-back-with-biome-data/
    • iLEAPP Biome Plugins
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeAppinstall.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBacklight.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBattperc.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBluetooth.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeCarplayisconnected.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeDevplugin.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeHardware.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeInfocus.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeIntents.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeLocationactivity.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNotes.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNotificationsPub.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNowplaying.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeSafari.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeSync.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeTextinputses.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeUseractmeta.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeWifi.py
  • /db/dhcpd_leases*
    • iLEAPP DHCP Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/dhcphp.py
  • /db/dhcpclient/
    • MAC Apt Networking Plugin
      • https://github.com/ydkhatri/mac_apt/wiki/NETWORKING
    • Cellebrite CTF 2020: Juan Mortyme
      • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
    • Apple TV Forensics 03: Analysis
      • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iLEAPP DHCP Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/dhcpl.py
  • /db/diagnostics/
    • Apple Unified Logging and Activity Tracing formats
      • https://github.com/libyal/dtformats/blob/main/documentation/Apple%20Unified%20Logging%20and%20Activity%20Tracing%20formats.asciidoc
    • Browsing the unified log in difficult circumstances
      • https://eclecticlight.co/2017/09/25/browsing-the-unified-log-in-difficult-circumstances/
    • Reviewing macOS Unified Logs
      • https://www.mandiant.com/resources/blog/reviewing-macos-unified-logs
    • Finding Waldo: Leveraging the Apple Unified Log for Incident Response
      • https://www.crowdstrike.com/blog/how-to-leverage-apple-unified-log-for-incident-response/ https://objectivebythesea.org/v3/talks/OBTS_v3_jMusunuri_eMartin.pdf
    • Unified Log Reader
      • https://github.com/ydkhatri/UnifiedLogReader
    • Upgrade From NULL—Detecting iOS Wipe Artifacts
      • https://dfir.pubpub.org/pub/6i7d593n/release/1
    • Logs Unite! - Forensic Analysis of Apple Unified Logs
      • https://github.com/mac4n6/Presentations/blob/master/Logs%20Unite!%20-%20Forensic%20Analysis%20of%20Apple%20Unified%20Logs/LogsUnite.pdf
    • Introducing 'Analysis of Apple Unified Logs: Quarantine Edition' [Entry 0]
      • https://www.mac4n6.com/blog/2020/4/19/introducing-analysis-of-apple-unified-logs-quarantine-edition-entry-0

"/installd/" folder

  • /installd/Library/Logs/MobileInstallation/mobile_installation.log.*
    • CyberDefenders - Jailbreak CTF
      • https://www.netscylla.com/blog/2022/06/09/Cyberdefenders-Jailbreak-CTF.html
    • iOS Mobile Installation Logs
      • https://dfir.pubpub.org/pub/e5xlbw88/release/2
    • iOS Mobile Installation Logs
      • https://dfrws.org/wp-content/uploads/2019/10/2019_review-ios_mobile_installation_logs.pdf
    • iOS Mobile Installation Logs Parser
      • https://abrignoni.blogspot.com/2019/01/ios-mobile-installation-logs-parser.html
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Using Apple “Bug Reporting” for forensic purposes
      • https://for585.com/sysdiagnose
    • Apple TV Forensics 03: Analysis
      • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
    • iLEAPP Mobile Installation Log Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/mobileInstall.py
  • /installd/Library/Logs/MobileInstallation/LastBuildInfo.plist
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Cellebrite CTF 2020: Ruth Langmore
      • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
    • iLEAPP Last Build Info Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/lastBuild.py
  • /installd/Library/Logs/MobileInstallation/MigrationInfo.plist
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
  • /installd/Library/Logs/MobileInstallation/RoleUserMigration.plist
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/

"/logs/" folder

  • /logs/lockdownd.log
    • So Long Lockdown!
      • http://www.doubleblak.com/m/blogPosts.php?id=9
    • KnowledgeC (and Friends)
      • http://www.doubleblak.com/m/blogPosts.php?id=2
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /logs/usermanagerd.log.*
  • /logs/wifimanager.log

"/mobile/Containers/" folder

  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/Caches/com.apple.mobilesafari/Cache.db
    • Getting Started with iOS Forensics
      • https://www.systoolsgroup.com/forensics/sqlite/ios.html
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Containers/Data/Application//Library/Caches/com.apple.WebAppCache/ApplicationCache.db
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Containers/Data/Application//Library/Cookies/Cookies.binarycookies
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/ImageCache/Favicons/Favicon.db
    • Favicons
      • https://www.doubleblak.com/m/blogPosts.php?id=13
    • iLEAPP Favicon Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariFavicons.py
  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/Preferences/com.apple.mobilesafari.plist
    • iOS 14 - First Thoughts and Analysis
      • https://blog.d204n6.com/2020/09/ios-14-first-thoughts-and-analysis.html
    • iLEAPP Recent Web Searches Safari Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariRecentWebSearches.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/Safari/Downloads/Downloads.plist
    • iOS / macOS - Tracking Downloads from Safari Without Downloads
      • https://blog.d204n6.com/2021/05/ios-macos-tracking-downloads-from.html
    • Safari and iPhone Internet History Parser
      • http://az4n6.blogspot.com/2014/07/safari-and-iphone-internet-history.html
  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/Safari/Thumbnails/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Containers/Data/Application/"Apple Safari GUID"/Library/WebKit/WebsiteData/LocalStorage/
    • Mobile Cyber Forensic Investigations of Web3 Wallets on Android and iOS
      • https://www.mdpi.com/2076-3417/12/21/11180
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
  • /mobile/Containers/Data/Application/"Apple Maps GUID"/Library/Maps/GeoHistory.mapsdata
    • Just Call Me Buffy the Proto Slayer – An Initial Look into Protobuf Data in Mac and iOS Forensics
      • http://www.mac4n6.com/blog/2019/9/27/just-call-me-buffy-the-proto-slayer-an-initial-look-into-protobuf-data-in-mac-and-ios-forensics
    • ROTTEN TO THE CORE? NAH, IOS14 IS MOSTLY SWEET
      • https://smarterforensics.com/2020/09/rotten-to-the-core-nah-ios14-is-mostly-sweet/
    • HOW THE GRINCH STOLE APPLE MAPS ARTIFACTS… OR DID HE JUST HIDE THEM?
      • https://smarterforensics.com/2016/12/how-the-grinch-stole-apple-maps-artifacts-or-did-he-just-hide-them/
    • FIRST THE GRINCH AND NOW THE EASTER BUNNY! WHERE IS APPLE MAPS HIDING?
      • https://smarterforensics.com/2018/03/first-the-grinch-and-now-the-easter-bunny-where-is-apple-maps-hiding/
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • Find Me If You Can: Mobile GPS Mapping Applications Forensic Analysis & SNAVP the Open Source, Modular, Extensible Parser Analysis & SNAVP the Open Source, Modular, Extensible Parser
      • https://commons.erau.edu/cgi/viewcontent.cgi?article=1414&context=jdfsl
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Containers/Data/Application/"Apple Maps GUID"/Library/Preferences/com.apple.Maps.plist
    • HOW THE GRINCH STOLE APPLE MAPS ARTIFACTS… OR DID HE JUST HIDE THEM?
      • https://smarterforensics.com/2016/12/how-the-grinch-stole-apple-maps-artifacts-or-did-he-just-hide-them/
    • FIRST THE GRINCH AND NOW THE EASTER BUNNY! WHERE IS APPLE MAPS HIDING?
      • https://smarterforensics.com/2018/03/first-the-grinch-and-now-the-easter-bunny-where-is-apple-maps-hiding/
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Containers/Shared/AppGroup/"Apple Maps GUID"/Maps/MapsSync_0.0.1
    • What Apple Maps Activity Can be Found Using a Logical Extraction
      • https://lordtemplar1.wordpress.com/2022/05/08/what-apple-maps-activity-can-be-found-using-a-logical-extraction/
    • iOS14 Maps History BLOB Script
      • http://cheeky4n6monkey.blogspot.com/2020/11/ios14-maps-history-blob-script.html https://github.com/cheeky4n6monkey/4n6-scripts/blob/master/iOS/ios14_maps_history.py
    • ROTTEN TO THE CORE? NAH, IOS14 IS MOSTLY SWEET
      • https://smarterforensics.com/2020/09/rotten-to-the-core-nah-ios14-is-mostly-sweet/
    • iLEAPP Maps Sync Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/mapsSync.py

"/mobile/Library/" folder

  • /mobile/Library/Accounts/Accounts3.sqlite
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS - Tracking Device Migration
      • https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • Cellebrite CTF 2022 - Beth's iPhone
      • https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-beths-iphone.html
    • Magnet Forensics Virtual Summit 2023 CTF – iOS
      • https://www.forgottennook.com/blog/magnet-ios-2023
    • Case Study: Forensic Analysis of TikTok on iOS
      • https://dfir.pubpub.org/pub/h6vyh33u/release/1
    • iLEAPP Accounts Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/accs.py
    • Accounts3.sqlite query
      • https://github.com/kacos2000/Queries/blob/master/Accounts3_sqlite.sql
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/AddressBook/AddressBook.sqlitedb
    • Getting Started with iOS Forensics
      • https://www.systoolsgroup.com/forensics/sqlite/ios.html
    • Identification and analysis of email and contacts artefacts on iOS and OS X
      • https://researchonline.gcu.ac.uk/ws/portalfiles/portal/24600592/K.Ovens_PID4325955.pdf
    • TIME IS NOT ON OUR SIDE WHEN IT COMES TO MESSAGES IN IOS 11
      • https://smarterforensics.com/2017/09/time-is-not-on-our-side-when-it-comes-to-messages-in-ios-11/
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • ROTTEN TO THE CORE? NAH, IOS14 IS MOSTLY SWEET
      • https://smarterforensics.com/2020/09/rotten-to-the-core-nah-ios14-is-mostly-sweet/
    • How To Identify When an IPhone or iPad was Factory Reset
      • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
    • A Digital Forensic Analysis on the iCloud® and its Synchronization to Apple® Devices
      • https://www.marshall.edu/forensics/files/FRIEDMANRACHEL-Research-Paper-08242012.pdf
    • Upgrade From NULL—Detecting iOS Wipe Artifacts
      • https://dfir.pubpub.org/pub/6i7d593n/release/1
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • AddressBook.sqlitedb query
      • https://github.com/kacos2000/Queries/blob/master/AddressBook_sqlite.sql
    • iPhone Artifacts - Champlain College
      • https://www.champlain.edu/Documents/LCDI/iPhone%20Artifacts.pdf
    • iLEAPP Address Book Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/addressBook.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/AddressBook/AddressBookImages.sqlitedb
    • Identification and analysis of email and contacts artefacts on iOS and OS X
      • https://researchonline.gcu.ac.uk/ws/portalfiles/portal/24600592/K.Ovens_PID4325955.pdf
    • IOS 13 – SUMMARY FOR THOSE OF YOU WHO ENJOY THE CLIFFSNOTES
      • https://smarterforensics.com/2019/09/ios-13-summary-for-those-of-you-who-enjoy-the-cliffsnotes/
    • AddressBookImages.sqlitedb query
      • https://github.com/kacos2000/Queries/blob/master/AddressBookImages_sqlite.sql
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/AggregatedDictionary/ADDataStore.sqlitedb
    • Pincodes, Passcodes, & TouchID on iOS - An Introduction to the Aggregate Dictionary Database (ADDataStore.sqlite)
      • https://www.mac4n6.com/blog/2017/3/12/introduction-to-the-aggregate-dictionary-database-addatastoresqlite
    • On the Fifth Day of APOLLO, My True Love Gave to Me – A Stocking Full of Random Junk, Some of Which Might be Useful!
      • https://www.mac4n6.com/blog/2018/12/18/on-the-fifth-day-of-apollo-my-true-love-gave-to-me-a-stocking-full-of-random-junk-some-of-which-might-be-useful
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • Forensics Tools: Stop Miscalculating iOS Usage Analytics!
      • https://www.zdziarski.com/blog/?p=2686
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • APOLLO ADDataStore Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/aggregate_dictionary_scalars.txt https://github.com/mac4n6/APOLLO/blob/master/modules/aggregate_dictionary_distributed_keys.txt
  • /mobile/Library/AppConduit/AvailableApps.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/AppConduit/AvailableCompanionApps.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/Application Support/com.apple.remotemanagmentd/RMAdminStore-Cloud.sqlite
    /mobile/Library/Application Support/com.apple.remotemanagmentd/RMAdminStore-Local.sqlite
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • ScreenTimeController
      • https://github.com/Evian-Zhang/ScreenTimeController/blob/master/README.md
    • Data Quality and Quantity – How to Get the Best of Both Worlds, Part 2 – Examining Screen Time Artifacts
      • https://cellebrite.com/en/data-quality-and-quantity-how-to-get-the-best-of-both-worlds-part-2-examining-screen-time-artifacts/
    • A Look Into Apple’s Screen Time Feature and What Insights It Lends To Digital Intelligence
      • https://cellebrite.com/en/a-look-into-apples-screen-time-feature-and-what-insights-it-lends-to-digital-intelligence/
    • iOS Screentine And Android Digital Wellbeing Apps
      • https://www.forensicfocus.com/webinars/ios-screentine-and-android-digital-wellbeing-apps/
    • Getting Evidence from iOS Screen Time Artifacts
      • https://www.magnetforensics.com/blog/getting-evidence-from-ios-screen-time-artifacts/
    • Plaso iOS SceenTime Parser
      • https://plaso.readthedocs.io/en/latest/_modules/plaso/parsers/sqlite_plugins/ios_screentime.html
    • A Look Into Apple’s Screen Time Feature and What Insights It Lends To Forensics
      • https://www.goldencelle.com/post/a-look-into-apple-s-screen-time-feature-and-what-insights-it-lends-to-forensics
    • Cellebrite CTF 2020: Ruth Langmore
      • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
    • Magnet Forensics Virtual Summit 2023 CTF – iOS
      • https://www.forgottennook.com/blog/magnet-ios-2023
    • Magnet 2022 CTF – iOS15
      • https://bakerstreetforensics.com/2022/07/28/magnet-2022-ctf-ios15/
    • MAC Apt SceenTime Plugin
      • https://github.com/ydkhatri/mac_apt/blob/master/plugins/screentime.py
    • APOLLO ScreenTime Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/screentime_timed_items.txt https://github.com/mac4n6/APOLLO/blob/master/modules/screentime_counted_items.txt https://github.com/mac4n6/APOLLO/blob/master/modules/screentime_by_hour.txt https://github.com/mac4n6/APOLLO/blob/master/modules/screentime_by_category.txt
  • /mobile/Library/ApplicationSync/AssetSortOrder.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/Assistant/SiriAnalytics.db
    • Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
      • https://blog.digital-forensics.it/2022/11/sysdiagnose-in-ios-16-first-look-from.html
  • /mobile/Library/Biome/
    • Analyzing iOS Biome AppIntent Files
      • https://bluecrewforensics.com/2022/03/07/ios-app-intents/
    • iOS 16 - Now You 'C' It, Now You Don't -- Breaking Down The Biomes Part 1
      • https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html
    • iOS 16 Breaking Down the Biomes Part 2 - AppInstalls, AppLaunch, & AppIntents
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-2.html
    • iOS 16 - Breaking Down the Biomes (Part 3) - Keeping up with CarPlay
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-3.html
    • iOS 16 - Breaking Down the Biomes (Part 4) - Surfin' with Safari
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-4.html
    • iOS 16 - Breaking Down the Biomes Part 5 -- "Hey Siri, find me some more data..."
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-5-hey.html
    • Bringing it Back With Biome Data
      • https://www.magnetforensics.com/blog/bringing-it-back-with-biome-data/
    • An Alternate Location for Deleted SMS/iMessage Data in Apple Devices
      • https://sqlmcgee.wordpress.com/2022/03/28/an-alternate-location-for-deleted-sms-imessage-data-in-apple-devices-2/ https://dfir.pubpub.org/pub/yp6efc8q/release/1
    • Lagging for the Win: Querying for Negative Evidence in the sms.db
      • https://belkasoft.com/lagging-for-win
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
    • Magnet Forensics Virtual Summit 2023 CTF – iOS
      • https://www.forgottennook.com/blog/magnet-ios-2023
    • Magnet Virtual Summit 2023 CTF - iOS 16 iPhone
      • https://www.stark4n6.com/2023/03/magnet-virtual-summit-2023-ctf-ios-16.html
    • iLEAPP Biome Plugins
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeAppinstall.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBacklight.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBattperc.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeBluetooth.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeCarplayisconnected.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeDevplugin.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeHardware.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeInfocus.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeIntents.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeLocationactivity.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNotes.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNotificationsPub.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeNowplaying.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeSafari.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeSync.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeTextinputses.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeUseractmeta.py https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/biomeWifi.py
  • /mobile/Library/BulletinBoard/ClearedSections.plist
    • Artifacts of an IOS device
      • https://infosecaddicts.com/artifacts-ios-device/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
  • /mobile/Library/Caches/com.apple.Pasteboard/*
  • /mobile/Library/Caches/com.apple.findmy.fmipcore/
    • Stored AirTag (and Other) Aritfacts
      • https://blog.d204n6.com/2022/04/airtag-youre-it.html
    • AirTags within iOS File Systems
      • https://medium.com/@Appalachian4n6/airtags-within-ios-file-systems-279dc783b69f
    • iLEAPP AirTags Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/airtags.py
  • /mobile/Library/Caches/com.apple.routined/Cache.sqlite
    • Locations, Locations, Locations
      • https://doubleblak.com/blogPosts.php?id=14 https://doubleblak.com/BlogArticles/14/PDF2.pdf
    • On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map of My Recent Travels – iOS Location Analysis
      • http://www.mac4n6.com/blog/2018/12/23/on-the-tenth-day-of-apollo-my-true-love-gave-to-me-an-oddly-detailed-map-of-my-recent-travels-ios-location-analysis
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • iOS Location Artifacts Explained
      • https://cellebrite.com/en/ios-location-artifacts-explained/
    • Location Data on iOS and Android Devices
      • https://cellebrite.com/en/episode-15-ibeg-to-dfir-location-data-on-ios-and-android-devices/
    • Apple Probably Knows What You Did Last Summer
      • https://blog.elcomsoft.com/2018/06/apple-probably-knows-what-you-did-last-summer/
    • UAV Forensics: DJI Mini 2 Case Study
      • https://www.researchgate.net/publication/352058134_UAV_Forensics_DJI_Mini_2_Case_Study
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • Building a Pattern of Life - Leveraging Location and Health Data
      • https://www.youtube.com/watch?v=eU7THDwFkiM
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • iPhone Device Speeds via Cache.sqlite > ZRTCLLOCATIONMO table
      • https://theforensicscooter.com/2021/09/22/iphone-device-speeds-in-cache-sqlite-zrtcllocationmo/
    • Vehicle and iPhone Speed Comparison
      • https://theforensicscooter.com/2022/07/01/vehicle-and-iphone-speed-comparison/
    • Cache.sqlite query
      • https://github.com/ScottKjr3347/iOS_Cache.sqlite_Queries
    • APOLLO iOS Routined Cache Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cache_zrtcllocationmo.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cache_zrthintmo.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cache_zrvisitmo.txt
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Caches/com.apple.routined/Cloud.sqlite
    /mobile/Library/Caches/com.apple.routined/Cloud-V2.sqlite
    • Locations, Locations, Locations
      • https://doubleblak.com/blogPosts.php?id=14 https://doubleblak.com/BlogArticles/14/PDF2.pdf
    • On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map of My Recent Travels – iOS Location Analysis
      • http://www.mac4n6.com/blog/2018/12/23/on-the-tenth-day-of-apollo-my-true-love-gave-to-me-an-oddly-detailed-map-of-my-recent-travels-ios-location-analysis
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • iOS Location Artifacts Explained
      • https://cellebrite.com/en/ios-location-artifacts-explained/
    • Location Data on iOS and Android Devices
      • https://cellebrite.com/en/episode-15-ibeg-to-dfir-location-data-on-ios-and-android-devices/
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Apple Probably Knows What You Did Last Summer
      • https://blog.elcomsoft.com/2018/06/apple-probably-knows-what-you-did-last-summer/
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
    • Building a Pattern of Life - Leveraging Location and Health Data
      • https://www.youtube.com/watch?v=eU7THDwFkiM
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • APOLLO iOS Routined Cloud Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_entry.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_exit.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_inbound_start.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_inbound_stop.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_outbound_start.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_visit_outbound_stop.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_address.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_cloud_mapitem.txt
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Caches/com.apple.routined/Local.sqlite
    • Locations, Locations, Locations
      • https://doubleblak.com/blogPosts.php?id=14
      https://doubleblak.com/BlogArticles/14/PDF2.pdf
    • On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map of My Recent Travels – iOS Location Analysis
      • http://www.mac4n6.com/blog/2018/12/23/on-the-tenth-day-of-apollo-my-true-love-gave-to-me-an-oddly-detailed-map-of-my-recent-travels-ios-location-analysis
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • iOS Location Artifacts Explained
      • https://cellebrite.com/en/ios-location-artifacts-explained/
    • Location Data on iOS and Android Devices
      • https://cellebrite.com/en/episode-15-ibeg-to-dfir-location-data-on-ios-and-android-devices/
    • Building a Pattern of Life - Leveraging Location and Health Data
      • https://www.youtube.com/watch?v=eU7THDwFkiM
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • Cellebrite CTF 2022 - Beth's iPhone
      • https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-beths-iphone.html
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
    • APOLLO iOS Routined Local Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_learned_location_of_interest_entry.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_learned_location_of_interest_exit.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_learned_location_of_interest_transition_start.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_learned_location_of_interest_transition_stop.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_vehicle_parked.txt https://github.com/mac4n6/APOLLO/blob/master/modules/routined_local_vehicle_parked_history.txt
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Calendar/Calendar.sqlitedb
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • Calendar.sqlitedb query
      • https://github.com/kacos2000/queries/blob/master/calendar_sqlitedb.sql
    • iLEAPP Calendar Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/calendarAll.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Calendar/Extras.db
    • Extras.db query
      • https://github.com/kacos2000/queries/blob/master/calendar_extras.sql
  • /mobile/Library/CallHistoryDB/CallHistory.storedata
    • Missing SQLite Records Analysis
      • https://dfir.pubpub.org/pub/33vkc2ul/release/1
    • A GLIMPSE OF IOS 10 FROM A SMARTPHONE FORENSIC PERSPECTIVE
      • https://smarterforensics.com/2016/09/a-glimpse-of-ios-10-from-a-smartphone-forensic-perspective/
    • TIME IS NOT ON OUR SIDE WHEN IT COMES TO MESSAGES IN IOS 11
      • https://smarterforensics.com/2017/09/time-is-not-on-our-side-when-it-comes-to-messages-in-ios-11/
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • IOS 13 – SUMMARY FOR THOSE OF YOU WHO ENJOY THE CLIFFSNOTES
      • https://smarterforensics.com/2019/09/ios-13-summary-for-those-of-you-who-enjoy-the-cliffsnotes/
    • ROTTEN TO THE CORE? NAH, IOS14 IS MOSTLY SWEET
      • https://smarterforensics.com/2020/09/rotten-to-the-core-nah-ios14-is-mostly-sweet/
    • How To Identify When an IPhone or iPad was Factory Reset
      • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
    • iOS 14 - First Thoughts and Analysis
      • https://blog.d204n6.com/2020/09/ios-14-first-thoughts-and-analysis.html
    • Cellebrite CTF 2022 - Marsha's iPhone
      • https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-marshas-iphone.html
    • Mo’ SIMs, Mo’ Problems. Examining Phones with Dual SIMs.
      • https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • CallHistory Query
      • https://github.com/kacos2000/queries/blob/master/callhistory_storedata.sql
    • APOLLO CallHistory Module
      • https://github.com/mac4n6/APOLLO/blob/master/modules/call_history.txt
    • iLEAPP CallHistory Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/callHistory.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/CallHistoryDB/CallHistoryTemp.storedata
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/CallHistoryTransactions/
  • /mobile/Library/com.apple.ClipServices.clipserviced/ClipData.db
    • iOS 14 - Tracking App Clips in iOS 14
      • https://blog.d204n6.com/2020/09/ios-14-tracking-app-clips-in-ios-14.html
  • /mobile/Library/com.apple.itunesstored/itunesstored2.sqlitedb
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
  • /mobile/Library/com.apple.itunesstored/kvs.sqlitedb
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/CoreDuet/Knowledge/knowledgeC.db
    • Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage
      • http://www.mac4n6.com/blog/2018/8/5/knowledge-is-power-using-the-knowledgecdb-database-on-macos-and-ios-to-determine-precise-user-and-application-usage
    • Knowledge is Power II – A Day in the Life of My iPhone using knowledgeC.db
      • https://www.mac4n6.com/blog/2018/9/12/knowledge-is-power-ii-a-day-in-the-life-of-my-iphone-using-knowledgecdb
    • Extensive knowledgeC APOLLO Updates!
      • https://www.mac4n6.com/blog/2020/6/17/extensive-knowledgec-apollo-updates
    • Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
      • https://www.mac4n6.com/blog/2020/6/21/socially-distant-but-still-interacting-new-and-improved-updates-to-macosios-coreduet-interactioncdb-apollo-modules
    • Providing Context to iOS App Usage with knowledgeC.db and APOLLO
      • https://www.mac4n6.com/blog/2020/1/13/apollo-into-the-details-with-application-activities
    • On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice
      • https://www.mac4n6.com/blog/2018/12/16/on-the-third-day-of-apollo-my-true-love-gave-to-me-application-usage-to-determine-who-has-been-naughty-or-nice
    • On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to Prove You Listened to “All I Want for Christmas is You” Over and Over Since Before Thanksgiving
      • https://www.mac4n6.com/blog/2018/12/17/on-the-fourth-day-of-apollo-my-true-love-gave-to-me-media-analysis-to-prove-you-listened-to-all-i-want-for-christmas-is-you-over-and-over-since-before-thanksgiving
    • On the Sixth Day of APOLLO, My True Love Gave to Me – Blinky Things with Buttons – Device Status Analysis
      • https://www.mac4n6.com/blog/2018/12/19/on-the-sixth-day-of-apollo-my-true-love-gave-to-me-blinky-things-with-buttons-device-status-analysis
    • On the Eighth Day of APOLLO, My True Love Gave to Me – A Glorious Lightshow – Analysis of Device Connections
      • http://www.mac4n6.com/blog/2018/12/21/on-the-eighth-day-of-apollo-my-true-love-gave-to-me-a-glorious-lightshow-analysis-of-device-connections
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
    • Apple TV Forensics 03: Analysis
      • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
    • iOS KnowledgeC.db Notifications
      • https://theforensicscooter.com/2021/10/03/ios-knowledgec-db-notifications/
    • iOS KnowledgeC.db Notifications
      • https://dfir.pubpub.org/pub/g2v1z97i/release/1
    • KnowledgeC: Now Playing entries
      • https://www.forensicmike1.com/2019/10/07/knowledgec-now-playing-entries/
    • USING PHOTOS.SQLITE TO SHOW THE RELATIONSHIPS BETWEEN PHOTOS AND THE APPLICATION THEY WERE CREATED WITH? BY SCOTT KOENIG
      • https://dfir.pubpub.org/pub/v19rksyf/release/1 https://smarterforensics.com/2020/08/does-photos-sqlite-have-relations-with-cameramessagesapp-by-scott-koenig/
    • KnowledgeC (and Friends)
      • http://www.doubleblak.com/m/blogPosts.php?id=2
    • Building a Pattern of Life - Leveraging Location and Health Data
      • https://www.youtube.com/watch?v=eU7THDwFkiM
    • iOS 16 - Now You 'C' It, Now You Don't -- Breaking Down The Biomes Part 1
      • https://blog.d204n6.com/2022/09/ios-16-now-you-c-it-now-you-dont.html
    • iOS - Tracking Traces of Deleted Applications
      • https://blog.d204n6.com/2019/09/ios-tracking-traces-of-deleted.html
    • Tracking Traces of Deleted Applications - SANS DFIR Summit 2019
      • https://www.youtube.com/watch?v=4LcQm4ErXpA
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • KwnoledgeC queries
      • https://github.com/ScottKjr3347/iOS_KnowledgeC.db_Queries
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • APOLLO KnowledgeC Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_activity_level.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_activity_level_feedback.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_airplay_prediction.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_calendar.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_clock.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_mail.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_maps.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_notes.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_passbook.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_photos.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_safari.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_activity_weather.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_inFocus.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_install.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_intents.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_location_activity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_media_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_relevantshortcuts.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_app_webusage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_audio_bluetooth_connected.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_audio_input_route.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_audio_media_nowplaying.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_audio_output_route.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_calendar_event_title.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_charging_smart_topoff_checkpoint.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_dasd_activity_profile.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_dasd_battery_temperature.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_dasd_control_effort.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_battery_saver.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_batterylevel.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_carplay_connected.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_inferred_motion.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_is_backlit.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_keybag_locked.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_locked.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_locked_imputed.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_low_power_mode.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_orientation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_pluggedin.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_device_watch_nearby.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_discoverability_signals.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_discoverability_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_disk_subsystem_access.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_event_tombstone.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_family_prediction.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_inferred_microlocation_visit.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_knowledge_sync_addition_window.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_notification_usage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_paired_device_nearby.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_deletes_all.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_deletes_recent.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_edit_all.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_engagement.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_favorites_other.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_share_airdrop.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_share_all.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_photos_share_extension.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_portrait_entity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_portrait_topic.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_safari_browsing.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_segment_monitor.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_settings_doNotDisturb.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_sharesheet_feedback.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_siri.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_siri_activites.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_siri_flow_activity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_siri_service.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_spotlight_viewer_event.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_standby_timer.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_sync_addition_window.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_sync_deletion_bookmark.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_system_airplane_mode.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_system_tlc.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_system_userwakingevent.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_user_first_backlight_after_wakeup.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_user_interaction_app_directory.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_widget_refresh.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_widget_view.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_widgets_viewed.txt https://github.com/mac4n6/APOLLO/blob/master/modules/knowledge_wifi_connection.txt
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/CoreDuet/People/interactionC.db
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • KnowledgeC (and Friends)
      • http://www.doubleblak.com/m/blogPosts.php?id=2
    • Socially Distant but Still Interacting! New and Improved Updates to macOS/iOS CoreDuet interactionC.db APOLLO Modules
      • http://www.mac4n6.com/blog/2020/6/21/socially-distant-but-still-interacting-new-and-improved-updates-to-macosios-coreduet-interactioncdb-apollo-modules
    • Local Photo Library Photos.sqlite Query Variations & WHERE statements
      • https://theforensicscooter.com/2022/02/21/photos-sqlite-update/
    • Comparison of iOS backups: Encrypted vs Unencrypted
      • https://www.arcpointforensics.com/news/comparison-of-ios-backups
    • SANS 2022 DFIR Summit Queries
      • https://for585.com/dfirsummit22
    • APOLLO interactionC Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/interaction_contact_interactions.txt https://github.com/mac4n6/APOLLO/blob/master/modules/interaction_contact_interactions_keywords.txt
    • iLEAPP interactionC Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/interactionCcontacts.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/DataAccess/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Artifacts of an IOS device
      • https://infosecaddicts.com/artifacts-ios-device/
    • A Digital Forensic Analysis on the iCloud® and its Synchronization to Apple® Devices
      • https://www.marshall.edu/forensics/files/FRIEDMANRACHEL-Research-Paper-08242012.pdf
  • /mobile/Library/DeviceRegistry.state/activeStateMachine.plist
    • Apple Watch Forensics 02: Analysis
      • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
    • APPLE WATCH FORENSICS: IS IT EVER POSSIBLE, AND WHAT IS THE PROFIT?
      • https://www.forensicfocus.com/webinars/apple-watch-forensics-is-it-ever-possible-and-what-is-the-profit/ https://dfrws.org/wp-content/uploads/2019/06/2019_EU_pres-apple_watch_forensics_is_it_ever_possible_and_what_is_the_profit.pdf
    • Data Extraction and Forensic Analysis for Smartphone Paired Wearables and IoT Devices
      • https://www.researchgate.net/publication/339022164_Data_Extraction_and_Forensic_Analysis_for_Smartphone_Paired_Wearables_and_IoT_Devices
  • /mobile/Library/DeviceRegistry.state/historySecureProperties.plist
    • Apple Watch Forensics 02: Analysis
      • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
    • APPLE WATCH FORENSICS: IS IT EVER POSSIBLE, AND WHAT IS THE PROFIT?
      • https://www.forensicfocus.com/webinars/apple-watch-forensics-is-it-ever-possible-and-what-is-the-profit/ https://dfrws.org/wp-content/uploads/2019/06/2019_EU_pres-apple_watch_forensics_is_it_ever_possible_and_what_is_the_profit.pdf
    • Data Extraction and Forensic Analysis for Smartphone Paired Wearables and IoT Devices
      • https://www.researchgate.net/publication/339022164_Data_Extraction_and_Forensic_Analysis_for_Smartphone_Paired_Wearables_and_IoT_Devices
  • /mobile/Library/DoNotDisturb/DB/Settings.sqlite
  • /mobile/Library/DoNotDisturb/DB/IDSSyncEngineMetadata.plist
    • iOS 16 - Breaking Down the Biomes (Part 3) - Keeping up with CarPlay
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-3.html
  • /mobile/Library/DuetExpertCenter/streams/userNotificationEvent/local
    • Peeking at User Notification Events in iOS 15
      • https://gforce4n6.blogspot.com/2022/05/peeking-at-user-notification-events-in.html
    • Peeking at User Notification Events in iOS 15
      • https://dfrws.org/presentation/dfir-review-showcase-peeking-at-user-notification-events-in-ios-15/
    • iOS 16 - "Paul unsent a message." ... OR DID HE?!
      • https://blog.d204n6.com/2022/09/ios-16-paul-unsent-message-or-did-he.html
    • Magnet Forensics Virtual Summit 2023 CTF – iOS
      • https://www.forgottennook.com/blog/magnet-ios-2023
    • iLEAPP User Notifications Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/notificationsDuet.py
  • /mobile/Library/FrontBoard/applicationState.db
    • Identifying installed and uninstalled apps in iOS
      • https://abrignoni.blogspot.com/2018/12/identifying-installed-and-uninstalled.html
    • iOS - Tracking Traces of Deleted Applications
      • https://blog.d204n6.com/2019/09/ios-tracking-traces-of-deleted.html
    • Tracking Traces of Deleted Applications - SANS DFIR Summit 2019
      • https://www.youtube.com/watch?v=4LcQm4ErXpA
    • iOS Application Groups & Shared data
      • http://www.swiftforensics.com/2021/01/ios-application-groups-shared-data.html
    • iOS - Tracking Bundle IDs for Containers, Shared Containers, and Plugins
      • https://blog.d204n6.com/2020/09/ios-tracking-bundle-ids-for-containers.html
    • iOS – Tracking Bundle IDs for Containers, Shared Containers, and Plugins
      • https://www.magnetforensics.com/blog/ios-tracking-bundle-ids-for-containers-shared-containers-and-plugins/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Magnet Virtual Summit 2020 CTF (iOS)
      • https://www.stark4n6.com/2020/06/magnet-virtual-summit-2020-ctf-ios.html
    • iLEAPP Application State Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/applicationstate.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Health/ActivitySharing/contacts.dat
    • #DFIRFIT or Bust - A forensic exploration of iOS Health Data
      • https://github.com/mac4n6/Presentations/blob/master/%23DFIRFIT%20or%20BUST/DFIRFIT.pdf https://papers.put.as/papers/ios/2018/summit_archive_1528385073.pdf
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
  • /mobile/Library/Health/healthdb.sqlite
    • #DFIRFIT or Bust - A forensic exploration of iOS Health Data
      • https://papers.put.as/papers/ios/2018/summit_archive_1528385073.pdf https://github.com/mac4n6/Presentations/blob/master/%23DFIRFIT%20or%20BUST/DFIRFIT.pdf
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • Enriching Investigations with Apple Watch Data Through the healthdb_secure.sqlite Database
      • https://dfir.pubpub.org/pub/xqvcn3hj/release/1
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
    • Apple Health
      • https://media.rootcon.org/ROOTCON%2012/Talks/Apple%20Health.pdf
    • Health and Activity
      • https://www.elcomsoft.com/presentations/20200129_health_and_activity_evidence_en.pdf
    • Making a Murderer: Health Activity Edition
      • https://smarterforensics.com/wp-content/uploads/2018/11/Making-a-Murderer-Health-Edition_Stockholm.pdf
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • Audio and App Usage in Apple Health
      • https://www.stark4n6.com/2022/08/audio-and-app-usage-in-apple-health.html
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • healthdb.sqlite query
      • https://github.com/kacos2000/Queries/blob/master/healthdb.sql
  • /mobile/Library/Health/healthdb_secure.sqlite
    • #DFIRFIT or Bust - A forensic exploration of iOS Health Data
      • https://github.com/mac4n6/Presentations/blob/master/%23DFIRFIT%20or%20BUST/DFIRFIT.pdf https://papers.put.as/papers/ios/2018/summit_archive_1528385073.pdf
    • FROM APPLE SEEDS TO APPLE PIE
      • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
    • On the Second Day of APOLLO, My True Love Gave to Me - Holiday Treats and a Trip to the Gym - A Look at iOS Health Data
      • https://www.mac4n6.com/blog/2018/12/15/on-the-second-day-of-apollo-my-true-love-gave-to-me-holiday-treats-and-a-trip-to-the-gym-a-look-at-ios-health-data
    • Just Call Me Buffy the Proto Slayer – An Initial Look into Protobuf Data in Mac and iOS Forensics
      • http://www.mac4n6.com/blog/2019/9/27/just-call-me-buffy-the-proto-slayer-an-initial-look-into-protobuf-data-in-mac-and-ios-forensics
    • The iPhone Health App from a forensic perspective: can steps and distances registered during walking and running be used as digital evidence?
      • https://www.sciencedirect.com/science/article/pii/S1742287619300313 https://dfrws.org/sites/default/files/session-files/2019_EU_paper-the_iphone_health_app_from_a_forensic_perspective.pdf
    • The phone reveals your motion: Digital traces of walking, driving and other movements on iPhones
      • https://www.sciencedirect.com/science/article/abs/pii/S2666281721000780
    • Interpreting the location data extracted from the Apple Health database
      • https://www.sciencedirect.com/science/article/pii/S2666281723000057
    • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
      • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
    • Apple Health
      • https://media.rootcon.org/ROOTCON%2012/Talks/Apple%20Health.pdf
    • Health and Activity
      • https://www.elcomsoft.com/presentations/20200129_health_and_activity_evidence_en.pdf
    • Making a Murderer: Health Activity Edition
      • https://smarterforensics.com/wp-content/uploads/2018/11/Making-a-Murderer-Health-Edition_Stockholm.pdf
    • …WON’T YOU BACK THAT THING UP: A GLIMPSE OF IOS 13 ARTIFACTS
      • https://smarterforensics.com/2019/09/wont-you-back-that-thing-up-a-glimpse-of-ios-13-artifacts/
    • Audio and App Usage in Apple Health
      • https://www.stark4n6.com/2022/08/audio-and-app-usage-in-apple-health.html
    • Enriching Investigations with Apple Watch Data Through the healthdb_secure.sqlite Database
      • https://dfir.pubpub.org/pub/xqvcn3hj/release/1 https://sqlmcgee.wordpress.com/2022/04/01/enriching-investigations-with-apple-watch-data-through-the-healthdb_secure-sqlite-database/
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • Securing and Extracting Health Data: Apple Health vs. Google Fit
      • https://blog.elcomsoft.com/2019/01/securing-and-extracting-health-data-apple-health-vs-google-fit/
    • Building a Pattern of Life - Leveraging Location and Health Data
      • https://www.youtube.com/watch?v=eU7THDwFkiM
    • Health Data Types
      • https://www.doubleblak.com/blogPosts.php?id=21
    • Personal Injury & Insurance Fraud Investigation: Get the Mobile Device!
      • http://prodigital4n6.blogspot.com/2017/07/personal-injury-insurance-fraud.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • healthdb_secure.sqlite query
      • https://github.com/kacos2000/Queries/blob/master/healthdb_secure.sql
    • APOLLO health_secure.sqlite Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/health_distance.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_ecg_average_heart_rate.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_flights.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_heart_rate.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_steps.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_stood_up.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_weight.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_cadence.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_elevation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_general.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_humidity.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_indoor.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_location_latitude.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_location_longitude.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_max_ground_elevation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_mets.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_min_ground_elevation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_temperature.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_timeofday.txt https://github.com/mac4n6/APOLLO/blob/master/modules/health_workout_weather.txt
  • /mobile/Library/Health/Client/HealthApp.sqlite
    • Health Data Types
      • https://www.doubleblak.com/blogPosts.php?id=21
  • /mobile/Library/homed/datastore.sqlite
    • A journey into IoT Forensics - Episode 5 - Analysis of the Apple HomePod and the Apple Home Kit Environment (aka thanks RN Team!)
      • https://blog.digital-forensics.it/2021/01/a-journey-into-iot-forensics-episode-5.html
    • Forensic Analysis of Apple HomePod & Apple HomeKit Environment w/ Mattia Epifani - SANS DFIR Summit
      • https://www.youtube.com/watch?v=D8AOXCBkaTY
  • /mobile/Library/Keyboard/-dynamic.lm/dynamic-lexicon.dat
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • iLEAPP Keyboard Lexicon
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/keyboardLexicon.py
  • /mobile/Library/Keyboard/app_usage_database.plist
    • iLEAPP App Usage Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/keyboardAppUsage.py
  • /mobile/Library/Keyboard/langlikelihood.dat
    • Cellebrite CTF 2021 Writeup
      • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
  • /mobile/Library/Keyboard/UserDictionary.sqlite
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
  • /mobile/Library/Logs/AppConduit/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Using Apple “Bug Reporting” for forensic purposes
      • https://for585.com/sysdiagnose
    • iOS Sysdiagnose AppConduit script
      • https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts/blob/master/sysdiagnose-appconduit.py
    • iLEAPP AppConduit Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appConduit.py
  • /mobile/Library/Logs/AppleSupport/general.log
  • /mobile/Library/Logs/mobile_installation_helper.log*
  • /mobile/Library/Logs/mobileactivationd/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Using Apple “Bug Reporting” for forensic purposes
      • https://for585.com/sysdiagnose
    • Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
      • https://blog.digital-forensics.it/2022/11/sysdiagnose-in-ios-16-first-look-from.html
    • A journey into IoT Forensics - Episode 5 - Analysis of the Apple HomePod and the Apple Home Kit Environment (aka thanks RN Team!)
      • https://blog.digital-forensics.it/2021/01/a-journey-into-iot-forensics-episode-5.html
    • Apple TV Forensics 03: Analysis
      • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
    • iLEAPP Mobile Activation Logs Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/mobileActivationLogs.py
  • /mobile/Library/Mail/
    • iOS Mail
      • https://www.doubleblak.com/m/blogPosts.php?id=10
    • Identification and analysis of email and contacts artefacts on iOS and OS X
      • https://researchonline.gcu.ac.uk/ws/portalfiles/portal/24600592/K.Ovens_PID4325955.pdf
    • A Digital Forensic Analysis on the iCloud® and its Synchronization to Apple® Devices
      • https://www.marshall.edu/forensics/files/FRIEDMANRACHEL-Research-Paper-08242012.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Getting Started with iOS Forensics
      • https://www.systoolsgroup.com/forensics/sqlite/ios.html
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/MedicalID/MedicalIDData.Archive
    • Magnet Virtual Summit 2020 CTF (iOS)
      • https://www.stark4n6.com/2020/06/magnet-virtual-summit-2020-ctf-ios.html
    • iLEAPP MedicalID Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/medicalID.py
  • /mobile/Library/NanoBackup/
  • /mobile/Library/NanoMusicSync/
  • /mobile/Library/NanoPreferencesSync/
    • Apple Watch Forensics 02: Analysis
      • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
  • /mobile/Library/NanoTimeKit/
  • /mobile/Library/Passes/passes23.sqlite
    • Pocket Litter A Peek Inside Your Apple Wallet
      • https://objectivebythesea.org/v4/talks/OBTS_v4_sEdwards.pdf
    • Analysing Apple Pay Transactions
      • https://blog.elcomsoft.com/2018/08/analysing-apple-pay-transactions/
    • Cellebrite CTF 2020: Juan Mortyme
      • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
    • Cellebrite CTF 2021 Writeup
      • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Apple Pattern of Life Lazy Output’er (APOLLO) Updates & 40 New Modules (Location, Chat, Calls, Apple Pay Transactions, Wallet Passes, Safari & Health Workouts)
      • http://www.mac4n6.com/blog/2019/1/17/apple-pattern-of-life-lazy-outputer-apollo-updates-amp-40-new-modules-location-chat-calls-apple-pay-transactions-wallet-passes-safari-amp-health-workouts?rq=passes23.sqlite
    • APOLLO passes23.sqlite Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/passes23_unique_passes_cards.txt https://github.com/mac4n6/APOLLO/blob/master/modules/passes23_wallet_passes.txt https://github.com/mac4n6/APOLLO/blob/master/modules/passes23_wallet_transactions.txt
    • iLEAPP passes23.sqlite Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appleWalletTransactions.py
  • /mobile/Library/PersonalizationPortrait/PPSQLDatabase.db
    • Guest Post by @bizzybarney! A Peek Inside the PPSQLDatabase.db Personalization Portrait Database
      • http://www.mac4n6.com/blog/2020/6/2/guest-post-by-bizzybarney-a-peek-inside-the-ppsqldatabasedb-personalization-portrait-database
    • Lucky (iOS) #13: Time to Press Your Bets w/ Jared Barnhart - SANS DFIR Summit 2020
      • https://www.youtube.com/watch?v=8Fy83iQ4f8Q
  • /mobile/Library/Preferences/.GlobalPreferences.plist
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
  • /mobile/Library/Preferences/addaily.plist
  • /mobile/Library/Preferences/com.apple.accountsettings.plist
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
  • /mobile/Library/Preferences/com.apple.ActivitySharing.plist
  • /mobile/Library/Preferences/com.apple.AdLib.plist
  • /mobile/Library/Preferences/com.apple.aggregated.plist
  • /mobile/Library/Preferences/com.apple.AppStore.plist
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Hacking and Securing iOS Applications by Jonathan Zdziarski, Chapter 4
      • https://www.oreilly.com/library/view/hacking-and-securing/9781449325213/ch04.html
  • /mobile/Library/Preferences/com.apple.assistant.backedup.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
  • /mobile/Library/Preferences/com.apple.assetsd.plist
    • Shared with You Syndication Photo Library – Message Attachments & Linked Assets
      • https://theforensicscooter.com/2022/09/16/shared-with-you-syndication-photo-library-message-attachments-linked-assets/
  • /mobile/Library/Preferences/com.apple.atc.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
      • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
  • /mobile/Library/Preferences/com.apple.BatteryCenter.BatteryWidget.plist
  • /mobile/Library/Preferences/com.apple.camera.plist
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
      • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
  • /mobile/Library/Preferences/com.apple.carplay.plist
    • Ridin’ With Apple CarPlay
      • https://thebinaryhick.blog/2019/05/08/ridin-with-apple-carplay/
    • They See Us Rollin’; They Hatin’: Forensics of iOS CarPlay and Android Auto
      • https://papers.put.as/papers/ios/2019/summit_archive_1564072550.pdf
    • iOS 16 - Breaking Down the Biomes (Part 3) - Keeping up with CarPlay
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-3.html
    • Digital Forensic Case Studies for In-Vehicle Infotainment Systems Using Android Auto and Apple CarPlay
      • https://www.mdpi.com/1424-8220/22/19/7196/pdf
    • Cellebrite CTF 2021 Writeup
      • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
    • Cellebrite CTF 2021 - Marsha's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-marshas-iphone.html
    • Auto-Parser: Android Auto and Apple CarPlay Forensics
      • https://link.springer.com/chapter/10.1007/978-3-031-06365-7_4 https://github.com/BiTLab-BaggiliTruthLab/Auto-Parser-Android-Auto-Apple-CarPlay
  • /mobile/Library/Preferences/com.apple.celestial.plist
    • Ridin’ With Apple CarPlay
      • https://thebinaryhick.blog/2019/05/08/ridin-with-apple-carplay/
    • Auto-Parser: Android Auto and Apple CarPlay Forensics
      • https://link.springer.com/chapter/10.1007/978-3-031-06365-7_4 https://github.com/BiTLab-BaggiliTruthLab/Auto-Parser-Android-Auto-Apple-CarPlay
  • /mobile/Library/Preferences/com.apple.cloud.quota.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/Preferences/com.apple.cloudphotod.plist
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
  • /mobile/Library/Preferences/com.apple.cmfsyncagent.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
  • /mobile/Library/Preferences/com.apple.commcenter.shared.plist
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.conference.plist
  • /mobile/Library/Preferences/com.apple.contacts.donation-agent.plist
  • /mobile/Library/Preferences/com.apple.contextstored.plist
  • /mobile/Library/Preferences/com.apple.CoreDuet.plist
  • /mobile/Library/Preferences/com.apple.CoreDuet.QueuedDenials.plist
  • /mobile/Library/Preferences/com.apple.coreduetd.batterysaver.state.plist
  • /mobile/Library/Preferences/com.apple.coreduetd.plist
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
  • /mobile/Library/Preferences/com.apple.corerecents.recentsd.plist
  • /mobile/Library/Preferences/com.apple.corespotlightui.plist
  • /mobile/Library/Preferences/com.apple.FeedbackAssistant.plist
  • /mobile/Library/Preferences/com.apple.homesharing.plist
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
  • /mobile/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist
  • /mobile/Library/Preferences/com.apple.icloud.fmfd.plist
    • iOS - Tracking Device Migration
      • https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html
  • /mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist
    • How iOS Properties Files Can Confirm a Suspect’s Contacts Even If Deleted
      • https://cellebrite.com/en/how-ios-properties-files-can-confirm-a-suspects-contacts-even-if-data-deleted/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Making the most of Property Lists
      • https://forensicskween.com/research/making-the-most-of-property-lists/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.imservice*.plist
  • /mobile/Library/Preferences/com.apple.locationd.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Location Services and System Services are they ON or OFF
      • https://dfir.pubpub.org/pub/4sv4kxyh/release/2
    • iOS Location Services and System Services ON or OFF?
      • https://theforensicscooter.com/2021/09/20/ios-location-services-and-system-services-on-or-off/
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.madrid.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Preferences/com.apple.messages.pinning.plist
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
  • /mobile/Library/Preferences/com.apple.migration.plist
    • iOS - Tracking Device Migration
      • https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
  • /mobile/Library/Preferences/com.apple.mmcs.plist
  • /mobile/Library/Preferences/com.apple.mobile.ldbackup.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.mobilegestalt.plist
    • WHO IS THE OWNER OF THE MOBILE DEVICE?
      • https://www.digitalforensics.com/blog/articles/who-is-the-owner-of-the-mobile-device/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.mobilephone.plist
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.mobileslideshow.plist
    • How to find iOS Hidden Assets
      • https://theforensicscooter.com/2022/07/29/how-to-find-ios-hidden-assets/
    • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
      • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
  • /mobile/Library/Preferences/com.apple.MobileSMS.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • What is the likelihood of recovering deleted iPhone messages?
      • https://improsec.com/tech-blog/what-is-the-likelihood-of-recovering-deleted-iphone-messages
    • Missing Pieces: Tips and Tricks on how to ensure your acquisitions aren’t missing critical data
      • https://static1.squarespace.com/static/62ab5b933d903d4c55e5d716/t/62fa28d8fd3a89429f8a9a80/1660561630138/MissingPieces_Hyde_Quezada_Final.pdf
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Preferences/com.apple.mt.lastLaunch.plist
  • /mobile/Library/Preferences/com.apple.nano.plist
  • /mobile/Library/Preferences/com.apple.nanoregistry.plist
  • /mobile/Library/Preferences/com.apple.preferences.datetime.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.preferences.network.plist
    • Artifacts of an IOS device
      • https://infosecaddicts.com/artifacts-ios-device/
    • Wireless Network Preferences – iOS
      • https://bitsplease4n6.wordpress.com/2020/12/17/wireless-network-preferences-ios/
  • /mobile/Library/Preferences/com.apple.Preferences.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.purplebuddy.plist
    • iOS - Tracking Device Migration
      • https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html
    • Putting a User Behind an iOS Device
      • https://dfrws.org/wp-content/uploads/2020/06/2020_USA_pres-putting_a_user_behind_an_ios_device.pdf
    • How was an iPhone set up?
      • https://dfir.pubpub.org/pub/2q177smo/release/5
    • Upgrade From NULL—Detecting iOS Wipe Artifacts
      • https://dfir.pubpub.org/pub/6i7d593n/release/1
    • How was an iPhone set up?
      • https://smarterforensics.com/2019/01/how-was-an-iphone-setup/
    • How To Identify When an IPhone or iPad was Factory Reset
      • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
  • /mobile/Library/Preferences/com.apple.sharingd.plist
    • Analysis of Apple Unified Logs: Quarantine Edition [Entry 11] – AirDropping Some Knowledge
      • http://www.mac4n6.com/blog/2020/6/5/analysis-of-apple-unified-logs-quarantine-edition-entry-11-airdropping-some-knowledge
    • EXTRACTING FORENSIC ARTIFACTS FROM APPLE CONTINUITY
      • https://smarterforensics.com/wp-content/uploads/2014/06/The-Cider-Press-DFIR_Summit2017.pdf
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/Preferences/com.apple.springboard.plist
    • Recover your iPhone Screen Time or restrictions passcode (supports iOS 14)
      • https://www.iphonebackupextractor.com/guides/recover-screen-time-parental-restrictions-passcode/
    • Artifacts of an IOS device
      • https://infosecaddicts.com/artifacts-ios-device/
    • Auto-Parser: Android Auto and Apple CarPlay Forensics
      • https://link.springer.com/chapter/10.1007/978-3-031-06365-7_4 https://github.com/BiTLab-BaggiliTruthLab/Auto-Parser-Android-Auto-Apple-CarPlay
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/Preferences/com.apple.timed.plist
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
  • /mobile/Library/Preferences/com.apple.weather.plist
  • /mobile/Library/Recents/Recents
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • Recents query
      • https://github.com/kacos2000/queries/blob/master/recents.sql
  • /mobile/Library/Reminders/
    • Cellebrite CTF 2020: Ruth Langmore
      • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
    • iLEAPP Reminders Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/reminders.py
  • /mobile/Library/Safari/Bookmarks.db
    • iOS 14 - First Thoughts and Analysis
      • https://blog.d204n6.com/2020/09/ios-14-first-thoughts-and-analysis.html
    • Getting Started with iOS Forensics
      • https://www.systoolsgroup.com/forensics/sqlite/ios.html
    • iLEAPP Safari Bookmarks Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariBookmarks.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Safari/BrowserState.db
    • Examining mobile devices: identiffying private internet browking activity in Mobile Safari
      • https://www.opentext.com/file_source/OpenText/en_US/PDF/Examining-mobiledevices-&-private-internet-browsing-activity-whitepaper-en.pdf
    • iOS 14 - First Thoughts and Analysis
      • https://blog.d204n6.com/2020/09/ios-14-first-thoughts-and-analysis.html
    • iLEAPP Safari Tabs Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariTabs.py
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Safari/CloudTabs.db
    • iLEAPP Safari Tabs Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariTabs.py
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Safari/History.db
    • Missing SQLite Records Analysis
      • https://dfir.pubpub.org/pub/33vkc2ul/release/1
    • Examining mobile devices: identiffying private internet browking activity in Mobile Safari
      • https://www.opentext.com/file_source/OpenText/en_US/PDF/Examining-mobiledevices-&-private-internet-browsing-activity-whitepaper-en.pdf
    • KnowledgeC (and Friends)
      • http://www.doubleblak.com/m/blogPosts.php?id=2
    • Cellebrite CTF 2020: Ruth Langmore
      • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Reading Your Browser's History with SQLite
      • http://2016.padjo.org/tutorials/sqlite-your-browser-history/
    • APOLLO Safari History Module
      • https://github.com/mac4n6/APOLLO/blob/master/modules/safari_history.txt
    • iLEAPP Safari History Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/safariHistory.py
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/Safari/SafariTabs.db
    • iOS 16 - Breaking Down the Biomes (Part 4) - Surfin' with Safari
      • https://blog.d204n6.com/2022/09/ios-16-breaking-down-biomes-part-4.html
    • iOS 16: What Digital Investigators Need to Know
      • https://www.magnetforensics.com/blog/ios-16-what-digital-investigators-need-to-know/
    • Checking in on iOS 16 in Magnet AXIOM 6.8
      • https://www.magnetforensics.com/blog/checking-in-on-ios-16-in-magnet-axiom-6-8/
  • /mobile/Library/SMS/Attachments/
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
    • Using Photos.sqlite to Show the Relationships Between Photos and the Application they were Created with?
      • https://dfir.pubpub.org/pub/v19rksyf/release/1 https://smarterforensics.com/2020/08/does-photos-sqlite-have-relations-with-cameramessagesapp-by-scott-koenig/
    • Shared with You Syndication Photo Library – Message Attachments & Linked Assets
      • https://theforensicscooter.com/2022/09/16/shared-with-you-syndication-photo-library-message-attachments-linked-assets/
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/SMS/Drafts/
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • iLEAPP Draft SMS Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/draftmessage.py
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/SMS/sms.db
    • The Meaning of Messages
      • https://www.magnetforensics.com/blog/the-meaning-of-messages/
    • iOS16 iMessages
      • https://doubleblak.com/blogPosts.php?id=27
    • iOS 16 - "Paul unsent a message." ... OR DID HE?!
      • https://blog.d204n6.com/2022/09/ios-16-paul-unsent-message-or-did-he.html
    • Message Reactions
      • https://doubleblak.com/blogPosts.php?id=24
    • Sharing Locations in iOS Messages
      • https://thebinaryhick.blog/2021/09/29/sharing-locations-in-ios-messages/
    • iOS 14 - Message Mentions and Threading
      • https://blog.d204n6.com/2020/09/ios-14-message-mentions-and-threading.html
    • Cellebrite CTF 2020: Juan Mortyme
      • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 19-5551 Summary Report
      • https://cts-forensics.com/reports/19-5551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • Lagging for the Win: Querying for Negative Evidence in the sms.db
      • https://belkasoft.com/lagging-for-win
    • An Alternate Location for Deleted SMS/iMessage Data in Apple Devices
      • https://sqlmcgee.wordpress.com/2022/03/28/an-alternate-location-for-deleted-sms-imessage-data-in-apple-devices-2/ https://dfir.pubpub.org/pub/yp6efc8q/release/1
    • Missing SQLite Records Analysis
      • https://dfir.pubpub.org/pub/33vkc2ul/release/1
    • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
      • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • How To Identify When an IPhone or iPad was Factory Reset
      • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
    • KnowledgeC (and Friends)
      • http://www.doubleblak.com/m/blogPosts.php?id=2
    • Temporal Analysis Anomalies with iOS iMessage Communication Exchange
      • https://personal.cis.strath.ac.uk/george.weir/cyfor14/papers/4_govan_ovans.pdf
    • iLEAPP SMS Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/sms.py
    • APOLLO SMS Modules
      • https://github.com/mac4n6/APOLLO/blob/master/modules/sms_chat.txt https://github.com/mac4n6/APOLLO/blob/master/modules/sms_chat_message_delivered.txt https://github.com/mac4n6/APOLLO/blob/master/modules/sms_chat_message_read.txt
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/SMS/sms-temp.db
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics for Investigators
      • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
  • /mobile/Library/SpringBoard/HomeBackgroundThumbnail.jpg
  • /mobile/Library/SpringBoard/IconState.plist
    • Today, Widgets, & Ignored Apps in iOS
      • https://thebinaryhick.blog/2021/07/25/today-widgets-ignored-apps-in-ios/
    • Recover iOS App Screen Layouts with the New iOS Home Screen Items Artifact
      • https://www.magnetforensics.com/blog/recover-ios-app-screen-layouts-with-the-new-ios-home-screen-items-artifact/
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iLEAPP Icon State Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/iconsScreen.py
    • A Few Interesting iOS Forensic Artefacts
      • https://salt4n6.com/2018/05/15/a-few-interesting-ios-forensic-artefacts/
    • iOS - Tracking Traces of Deleted Applications
      • https://blog.d204n6.com/2019/09/ios-tracking-traces-of-deleted.html
    • Tracking Traces of Deleted Applications - SANS DFIR Summit 2019
      • https://www.youtube.com/watch?v=4LcQm4ErXpA
    • Auto-Parser: Android Auto and Apple CarPlay Forensics
      • https://link.springer.com/chapter/10.1007/978-3-031-06365-7_4 https://github.com/BiTLab-BaggiliTruthLab/Auto-Parser-Android-Auto-Apple-CarPlay
    • They See Us Rollin’; They Hatin’: Forensics of iOS CarPlay and Android Auto
      • https://papers.put.as/papers/ios/2019/summit_archive_1564072550.pdf
  • /mobile/Library/SpringBoard/LockBackgroundThumbnail.jpg
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/SpringBoard/LockBackgroundThumbnaildark.jpg
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
  • /mobile/Library/SpringBoard/TodayViewArchive.plist
  • /mobile/Library/SpringBoard/PushStore/
    • pushstore_parser
      • https://github.com/jakev/pushstore-parser
    • iLEAPP PushStore Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/notificationsXI.py
  • /mobile/Library/Suggestions/query_predictions.db
    • iLEAPP Query Predictions Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/queryPredictions.py
    • APOLLO Query Predictions Module
      • https://github.com/mac4n6/APOLLO/blob/master/modules/query_predictions.txt
  • /mobile/Library/TCC/TCC.db
    • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
      • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
      • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
    • iOS Forensics: HFS+ file system, partitions and relevant evidences
      • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Analysis of Apple Unified Logs: Quarantine Edition [Entry 10] – You down with TCC? Yea, you know me! Tracking App Permissions and the TCC APOLLO Module
      • http://www.mac4n6.com/blog/2020/6/1/analysis-of-apple-unified-logs-quarantine-edition-entry-10-you-down-with-tcc-yea-you-know-me-tracking-app-permissions-and-the-tcc-apollo-module?rq=tcc
    • iLEAPP TCC Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/tcc.py
    • APOLLO TCC Module
      • https://github.com/mac4n6/APOLLO/blob/master/modules/tcc_db.txt
  • /mobile/Library/UserConfigurationProfiles/PublicEffectiveUserSettings.plist
    • iOS Settings Display Auto-Lock & Require Passcode
      • https://theforensicscooter.com/2021/09/05/ios-settings-display-auto-lock-require-passcode/
    • iOS Settings Display Auto-Lock & Require Passcode
      • https://dfir.pubpub.org/pub/khnqi0ff/release/1
    • Cellebrite CTF 2021 - Beth's iPhone
      • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-beths-iphone.html
    • Cellebrite CTF 2021 Writeup
      • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
  • /mobile/Library/UserConfigurationProfiles/UserSettings.plist
  • /mobile/Library/UserNotifications/
    • Magnet User Summit 2022 CTF - iPhone
      • https://www.stark4n6.com/2022/06/magnet-user-summit-2022-ctf-iphone.html
    • iLEAPP User Notifications Plugin
      • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/notificationsXII.py
    • Mobile Cyber Forensic Investigations of Web3 Wallets on Android and iOS
      • https://www.mdpi.com/2076-3417/12/21/11180
  • /mobile/Library/Voicemail/voicemail.db
    • iOS Voicemail Transcripts
      • https://www.linkedin.com/pulse/ios-voicemail-transcripts-charlie-rubisoff/
    • Dude, Where's My Banana? Retrieving data from an iPhone voicemail database
      • http://cheeky4n6monkey.blogspot.com/2013/01/dude-wheres-my-banana-retrieving-data.html
    • Dude, Where's My Data?
      • http://az4n6.blogspot.com/2012/12/dude-wheres-my-data.html
    • iOS Analysis Test No. 18-5551 Summary Report
      • https://cts-forensics.com/reports/38551_Web.pdf
    • iOS Analysis Test No. 20-5551 Summary Report
      • https://cts-forensics.com/reports/20-5551_Web.pdf
    • iOS Analysis Test No. 21-5551 Summary Report
      • https://cts-forensics.com/reports/21-5551_Web.pdf
    • iOS Analysis Test No. 22-5551 Summary Report
      • https://cts-forensics.com/reports/22-5551_Web.pdf
    • Practical Mobile Forensics - Fourth Edition
      • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520

    • "/mobile/Media/" folder

    • /mobile/Media/DCIM/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
        • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
      • How to find iOS Hidden Assets
        • https://theforensicscooter.com/2022/07/29/how-to-find-ios-hidden-assets/
      • USING PHOTOS.SQLITE TO SHOW THE RELATIONSHIPS BETWEEN PHOTOS AND THE APPLICATION THEY WERE CREATED WITH? BY SCOTT KOENIG
        • https://smarterforensics.com/2020/08/does-photos-sqlite-have-relations-with-cameramessagesapp-by-scott-koenig/ https://dfir.pubpub.org/pub/v19rksyf/release/1
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Cellebrite CTF 2021 Writeup
        • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
      • Cellebrite CTF 2020: Juan Mortyme
        • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
      • Cellebrite CTF 2022 - Marsha's iPhone
        • https://www.stark4n6.com/2022/06/cellebrite-ctf-2022-marshas-iphone.html
      • Magnet Forensics Virtual Summit 2023 CTF – iOS
        • https://www.forgottennook.com/blog/magnet-ios-2023
      • iOS Analysis Test No. 18-5551 Summary Report
        • https://cts-forensics.com/reports/38551_Web.pdf
      • iOS Analysis Test No. 19-5551 Summary Report
        • https://cts-forensics.com/reports/19-5551_Web.pdf
      • iOS Analysis Test No. 20-5551 Summary Report
        • https://cts-forensics.com/reports/20-5551_Web.pdf
      • iOS Analysis Test No. 21-5551 Summary Report
        • https://cts-forensics.com/reports/21-5551_Web.pdf
      • iOS Analysis Test No. 22-5551 Summary Report
        • https://cts-forensics.com/reports/22-5551_Web.pdf
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Cellebrite CTF 2020: Ruth Langmore
        • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
      • Apple TV Forensics 03: Analysis
        • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
      • Forensicating The Apple TV
        • https://www.forensicfocus.com/webinars/forensicating-the-apple-tv/
      • Apple Watch Forensics 02: Analysis
        • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
      • APPLE WATCH FORENSICS: IS IT EVER POSSIBLE, AND WHAT IS THE PROFIT?
        • https://www.forensicfocus.com/webinars/apple-watch-forensics-is-it-ever-possible-and-what-is-the-profit/ https://dfrws.org/wp-content/uploads/2019/06/2019_EU_pres-apple_watch_forensics_is_it_ever_possible_and_what_is_the_profit.pdf
      • iLEAPP Media Library Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/mediaLibrary.py
    • /mobile/Media/iTunesControl/iTunes/iTunesPrefs
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Forensic Analysis of iTunes Backups
        • https://farleyforensics.com/2019/04/14/forensic-analysis-of-itunes-backups/
    • /mobile/Media/MediaAnalysis/mediaanalysis.db
      • Follow-on to DFIR Summit Talk: Lucky (iOS) 13: Time To Press Your Bets (via @bizzybarney)
        • http://www.mac4n6.com/blog/2020/7/19/follow-on-to-dfir-summit-talk-lucky-ios-13-time-to-press-your-bets-via-bizzybarney
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /mobile/Media/PhotoData/AlbumsMetadata/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
    • /mobile/Media/PhotoData/PhotoCloudSharingData/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Local Photo Library Photos.sqlite Query Variations & WHERE statements
        • https://theforensicscooter.com/2022/02/21/photos-sqlite-update/
      • Photos.sqlite ZINTERNALRESOURCE Table Reference Guide
        • https://theforensicscooter.com/2022/12/03/photos-sqlite-zinternalresource-table-reference-guide/
      • Sharing is Caring – An Overview of Shared Albums in iOS
        • https://gforce4n6.blogspot.com/2020/09/sharing-is-caring-overview-of-shared.html
      • iLEAPP Shared Albumbs Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/icloudSharedalbums.py
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /mobile/Media/PhotoData/Caches/GraphService/CLSPublicEventCache.sqlite
    • /mobile/Media/PhotoData/CPL/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
        • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
      • How to find iOS Hidden Assets
        • https://theforensicscooter.com/2022/07/29/how-to-find-ios-hidden-assets/
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /mobile/Media/PhotoData/Photos.sqlite
      • Photos.sqlite Queries – Original Blog Posting
        • https://theforensicscooter.com/2021/11/23/photos-sqlite-queries/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Local Photo Library Photos.sqlite Query Variations & WHERE statements
        • https://theforensicscooter.com/2022/02/21/photos-sqlite-update/
      • How to find iOS Hidden Assets
        • https://theforensicscooter.com/2022/07/29/how-to-find-ios-hidden-assets/
      • Photos.sqlite ZINTERNALRESOURCE Table Reference Guide
        • https://theforensicscooter.com/2022/12/03/photos-sqlite-zinternalresource-table-reference-guide/
      • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
        • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
      • Part B Filling a device internal storage for Optimize iPhone Storage Research
        • https://theforensicscooter.com/2022/12/03/part-b-filling-a-device-internal-storage-for-optimize-iphone-storage-research/
      • iOS Media Adjustments
        • https://www.doubleblak.com/blogPosts.php?id=23
      • iOS Local Photo Library (PL) Photos.sqlite Queries
        • https://github.com/ScottKjr3347/iOS_Local_PL_Photos.sqlite_Queries
      • USING PHOTOS.SQLITE TO SHOW THE RELATIONSHIPS BETWEEN PHOTOS AND THE APPLICATION THEY WERE CREATED WITH? BY SCOTT KOENIG
        • https://smarterforensics.com/2020/08/does-photos-sqlite-have-relations-with-cameramessagesapp-by-scott-koenig/ https://dfir.pubpub.org/pub/v19rksyf/release/1
      • How Did That Photo Get on That iPhone? – Deep Dive into the iOS “Photos.sqlite” database
        • https://msab.com/guides-whitepapers/forensic-dive-into-ios-photos-sqlite-database/
      • How Did That Photo Get on That iPhone: Media Attribution for iOS
        • https://www.msab.com/blog/media-attribution-for-ios/
      • iOS Photos.sqlite Forensics
        • https://www.forensicmike1.com/2019/05/02/ios-photos-sqlite-forensics/
      • macOS & iOS Photos Support with Magnet AXIOM
        • https://www.magnetforensics.com/blog/macos-ios-photos-support-with-magnet-axiom/
      • Apple Watch Forensics 02: Analysis
        • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
      • Apple iOS: Recently Deleted images
        • https://forensenellanebbia.blogspot.com/2015/10/apple-ios-recently-deleted-images.html
      • The Apple Photos library
        • https://www.tonkata.com/posts/apple-photos/
      • Photos.sqlite query
        • https://github.com/kacos2000/queries/blob/master/Photos_sqlite.sql
      • iLEAPP Photos Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/photosMetadata.py
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /mobile/Media/PhotoData/Thumbnails/
      • iPhone Photodata Thumbnails
        • https://athenaforensics.co.uk/iphone-photodata-thumbnails/
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Do you have a Full-Sized Asset…or just a Thumbnail? Did Optimized iPhone Storage process occur?
        • https://theforensicscooter.com/2022/12/05/do-you-have-a-full-sized-assetor-just-a-thumbnail-did-optimized-iphone-storage-process-occur/
      • Photos.sqlite ZINTERNALRESOURCE Table Reference Guide
        • https://theforensicscooter.com/2022/12/03/photos-sqlite-zinternalresource-table-reference-guide/
      • iOS iThmbs
        • http://dig-forensics.blogspot.com/2013/05/ios-ithmbs.html
      • iThmb Converter
        • https://www.ithmbconverter.com/
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /mobile/Media/Recordings/
      • Forensic originality identification of iPhone’s voice memos
        • https://iopscience.iop.org/article/10.1088/1742-6596/1345/5/052053/pdf
      • A method of forensic authentication of audio recordings generated using the Voice Memos application in the iPhone
        • https://www.sciencedirect.com/science/article/abs/pii/S0379073821000220
      • Advanced forensic procedure for the authentication of audio recordings generated by Voice Memos application of iOS14
        • https://onlinelibrary.wiley.com/doi/abs/10.1111/1556-4029.15016
      • Cellebrite CTF 2020: Juan Mortyme
        • https://ciofecaforensics.com/2020/10/30/cellebrite-ctf-juan/
      • iLEAPP Voice Recordings Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/voiceRecordings.py
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520

    "/mobile/MobileSoftwareUpdate/" folder

    • /mobile/MobileSoftwareUpdate/restore.log
      • Restore Log - Tracking iOS Update History
        • https://www.stark4n6.com/2021/10/restore-log-tracking-ios-update-history.html
      • Cellebrite CTF 2021 Writeup
        • https://medium.com/@williamskosasi/cellebrite-ctf-2021-writeup-b73d821a708
      • iLEAPP restore.log Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/restoreLog.py

    "/networkd/" folder

    • /networkd/netusage.sqlite
      • Network and Application Usage using netusage.sqlite & DataUsage.sqlite iOS Databases
        • http://www.mac4n6.com/blog/2019/1/6/network-and-application-usage-using-netusagesqlite-amp-datausagesqlite-ios-databases
      • iOS - Tracking Traces of Deleted Applications
        • https://blog.d204n6.com/2019/09/ios-tracking-traces-of-deleted.html
      • Tracking Traces of Deleted Applications - SANS DFIR Summit 2019
        • https://www.youtube.com/watch?v=4LcQm4ErXpA
      • iOS Forensics: HFS+ file system, partitions and relevant evidences
        • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
      • iLEAPP Net Usage Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/netusage.py
      • APOLLO Netusage Module
        • https://github.com/mac4n6/APOLLO/blob/master/modules/netusage_zprocess.txt https://github.com/mac4n6/APOLLO/blob/master/modules/netusage_zliveusage.txt https://github.com/mac4n6/APOLLO/blob/master/modules/netusage_zliverouteperf.txt

    "/preferences/" folder

    • /preferences/com.apple.networkextension.plist
    • /preferences/com.apple.wifi.known-networks.plist
      • Apple Private Wi-Fi Addresses
        • https://ciofecaforensics.com/2020/10/24/apple-private-addresses/
      • Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
        • https://blog.digital-forensics.it/2022/11/sysdiagnose-in-ios-16-first-look-from.html
      • mac_apt WiFi Plugin
        • https://github.com/ydkhatri/mac_apt/blob/master/plugins/ios_wifi.py
    • /preferences/SystemConfiguration/com.apple.accounts.exists.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iLEAPP Conf Accounts Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/confaccts.py
    • /preferences/SystemConfiguration/com.apple.networkidentification.plist
      • Artifacts of an IOS device
        • https://infosecaddicts.com/artifacts-ios-device/
      • Everything You Always Wanted to Know About iTunes and iCloud Backups But Were Afraid to Ask
        • https://blog.elcomsoft.com/2014/03/itunes-icloud-backups/
    • /preferences/SystemConfiguration/com.apple.radios.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /preferences/SystemConfiguration/com.apple.wifi.plist
      • From iPhone to Access Point
        • https://www.forensicfocus.com/articles/from-iphone-to-access-point/
      • Apple Private Wi-Fi Addresses
        • https://ciofecaforensics.com/2020/10/24/apple-private-addresses/
      • Using Apple “Bug Reporting” for forensic purposes
        • https://for585.com/sysdiagnose
      • Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
        • https://blog.digital-forensics.it/2022/11/sysdiagnose-in-ios-16-first-look-from.html
      • Wifi Networks – iOS
        • https://bitsplease4n6.wordpress.com/2020/12/08/wifi-networks-ios/
      • Apple Watch Forensics 02: Analysis
        • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
      • iOS Forensics: HFS+ file system, partitions and relevant evidences
        • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
      • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
        • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
      • APPLE WATCH FORENSICS: IS IT EVER POSSIBLE, AND WHAT IS THE PROFIT?
        • https://www.forensicfocus.com/webinars/apple-watch-forensics-is-it-ever-possible-and-what-is-the-profit/ https://dfrws.org/wp-content/uploads/2019/06/2019_EU_pres-apple_watch_forensics_is_it_ever_possible_and_what_is_the_profit.pdf
      • A journey into IoT Forensics - Episode 5 - Analysis of the Apple HomePod and the Apple Home Kit Environment (aka thanks RN Team!)
        • https://blog.digital-forensics.it/2021/01/a-journey-into-iot-forensics-episode-5.html
      • Cellebrite CTF 2020: Ruth Langmore
        • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
      • iOS Analysis Test No. 18-5551 Summary Report
        • https://cts-forensics.com/reports/38551_Web.pdf
      • iOS Analysis Test No. 19-5551 Summary Report
        • https://cts-forensics.com/reports/19-5551_Web.pdf
      • iOS Analysis Test No. 20-5551 Summary Report
        • https://cts-forensics.com/reports/20-5551_Web.pdf
      • iOS Analysis Test No. 21-5551 Summary Report
        • https://cts-forensics.com/reports/21-5551_Web.pdf
      • iOS Analysis Test No. 22-5551 Summary Report
        • https://cts-forensics.com/reports/22-5551_Web.pdf
      • iOS Sysdiagnose Wi-Fi script
        • https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts/blob/master/sysdiagnose-wifi-plist.py
      • iLEAPP WiFi Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appleWifiPlist.py
      • mac_apt WiFi Plugin
        • https://github.com/ydkhatri/mac_apt/blob/master/plugins/ios_wifi.py
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /preferences/SystemConfiguration/com.apple.wifi-private-mac-networks.plist
      • Apple Private Wi-Fi Addresses
        • https://ciofecaforensics.com/2020/10/24/apple-private-addresses/
      • iLEAPP WiFi Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/appleWifiPlist.py
      • mac_apt WiFi Plugin
        • https://github.com/ydkhatri/mac_apt/blob/master/plugins/ios_wifi.py
    • /preferences/SystemConfiguration/NetworkInterfaces.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Sysdiagnose Network Interfaces script
        • https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts/blob/master/sysdiagnose-networkinterfaces.py
      • Using Apple “Bug Reporting” for forensic purposes
        • https://for585.com/sysdiagnose
      • iOS Analysis Test No. 21-5551 Summary Report
        • https://cts-forensics.com/reports/21-5551_Web.pdf
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /preferences/SystemConfiguration/preferences.plist

    "/root/" folder

    • /root/.obliterated
      • Upgrade From NULL—Detecting iOS Wipe Artifacts
        • https://dfir.pubpub.org/pub/6i7d593n/release/1
      • How To Identify When an IPhone or iPad was Factory Reset
        • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
      • iOS Analysis Test No. 20-5551 Summary Report
        • https://cts-forensics.com/reports/20-5551_Web.pdf
      • iOS Analysis Test No. 21-5551 Summary Report
        • https://cts-forensics.com/reports/21-5551_Web.pdf
      • iOS Analysis Test No. 22-5551 Summary Report
        • https://cts-forensics.com/reports/22-5551_Web.pdf
      • Cellebrite CTF 2020: Ruth Langmore
        • https://ciofecaforensics.com/2020/11/02/cellebrite-ctf-ruth/
    • /root/Library/Application Support/com.apple.wifianalyticsd/DeviceAnalyticsModel.sqlite
    • /root/Library/Application Support/com.apple.wifianalyticsd/WiFiNetworkStoreModel.sqlite
      • iLEAPP WifiNetworkStoreModel Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/wifiNetworkStoreModel.py
    • /root/Library/Caches/com.apple.wifid/ThreeBars.sqlite
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Locations, Locations, Locations
        • https://doubleblak.com/blogPosts.php?id=14
      • Harvested Locations
        • https://www.doubleblak.com/blogPosts.php?id=16
    • /root/Library/Caches/locationd/cache.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Ridin’ With Apple CarPlay
        • https://thebinaryhick.blog/2019/05/08/ridin-with-apple-carplay/
    • /root/Library/Caches/locationd/cache_encryptedA.db
      • New Script – iOS Locations Scraper
        • http://www.mac4n6.com/blog/2016/6/6/new-script-ios-locations-scraper
      • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
        • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
      • Getting Started with iOS Forensics
        • https://www.systoolsgroup.com/forensics/sqlite/ios.html
      • APOLLO cache_ecnryptedA/B Modules
        • https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_cdmacelllocation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_celllocation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_celllocationlocal.txt
    • /root/Library/Caches/locationd/cache_encryptedB.db
      • FROM APPLE SEEDS TO APPLE PIE
        • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
      • New Script – iOS Locations Scraper
        • http://www.mac4n6.com/blog/2016/6/6/new-script-ios-locations-scraper
      • Smartphone Privacy: How Your Smartphone Tracks Your Entire Life
        • https://conference.hitb.org/hitbsecconf2018pek/materials/D2T2%20-%20How%20Your%20Smartphone%20Tracks%20Your%20Entire%20Life%20-%20Vladimir%20Katalov.pdf
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Harvested Locations
        • https://www.doubleblak.com/blogPosts.php?id=16
      • APOLLO cache_ecnryptedA/B Modules
        • https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_cdmacelllocation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_celllocation.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedAB_celllocationlocal.txt
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /root/Library/Caches/locationd/cache_encryptedC.db
      • FROM APPLE SEEDS TO APPLE PIE
        • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
      • SANS 2022 DFIR Summit Queries
        • https://for585.com/dfirsummit22
      • APOLLO cache_ecnryptedC Modules
        • https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedC_motionstatehistory.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedC_stepcounthistory.txt https://github.com/mac4n6/APOLLO/blob/master/modules/locationd_cacheencryptedC_nataliehistory.txt
      • The phone reveals your motion: Digital traces of walking, driving and other movements on iPhones
        • https://www.sciencedirect.com/science/article/abs/pii/S2666281721000780
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /root/Library/Caches/locationd/clients.plist
      • iOS Location Services and System Services ON or OFF?
        • https://theforensicscooter.com/2021/09/20/ios-location-services-and-system-services-on-or-off/
      • iOS Location Services and System Services are they ON or OFF
        • https://dfir.pubpub.org/pub/4sv4kxyh/release/2
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /root/Library/Caches/locationd/consolidated.db
      • iOS GeoFences
        • http://www.doubleblak.com/m/blogPosts.php?id=22
      • BELKASOFT CTF JULY 2022: WRITE-UP
        • https://belkasoft.com/belkactf-jul2022-writeup
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /root/Library/Lockdown/data_ark.plist
      • Putting a User Behind an iOS Device
        • https://dfrws.org/wp-content/uploads/2020/06/2020_USA_pres-putting_a_user_behind_an_ios_device.pdf
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Oh no! I have a wiped iPhone, now what?
        • https://blog.digital-forensics.it/2021/05/oh-no-i-have-wiped-iphone-now-what.html
      • KnowledgeC (and Friends)
        • http://www.doubleblak.com/m/blogPosts.php?id=2
      • Magnet Virtual Summit 2020 CTF (iOS)
        • https://www.stark4n6.com/2020/06/magnet-virtual-summit-2020-ctf-ios.html
      • iOS - Tracking Device Migration
        • https://blog.d204n6.com/2021/06/ios-tracking-device-migration.html
      • iOS Analysis Test No. 22-5551 Summary Report
        • https://cts-forensics.com/reports/22-5551_Web.pdf
      • Artifacts of an IOS device
        • https://infosecaddicts.com/artifacts-ios-device/
    • /root/Library/Lockdown/escrow_records/
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Understanding usbmux and the iOS lockdown service
        • https://jon-gabilondo-angulo-7635.medium.com/understanding-usbmux-and-the-ios-lockdown-service-7f2a1dfd07ae
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /root/Library/Lockdown/pair_records/
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Understanding usbmux and the iOS lockdown service
        • https://jon-gabilondo-angulo-7635.medium.com/understanding-usbmux-and-the-ios-lockdown-service-7f2a1dfd07ae
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /root/Library/Logs/MobileContainerManager
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • How To Identify When an IPhone or iPad was Factory Reset
        • https://athenaforensics.co.uk/how-to-identify-when-an-iphone-or-ipad-was-factory-reset/
      • So Long Lockdown!
        • http://www.doubleblak.com/m/blogPosts.php?id=9
      • Upgrade From NULL—Detecting iOS Wipe Artifacts
        • https://dfir.pubpub.org/pub/6i7d593n/release/1
      • Using Apple “Bug Reporting” for forensic purposes
        • https://for585.com/sysdiagnose
      • Apple Watch Forensics 02: Analysis
        • https://blog.elcomsoft.com/2019/06/apple-watch-forensics-02-analysis/
      • Apple TV Forensics 03: Analysis
        • https://blog.elcomsoft.com/2019/09/apple-tv-forensics-03-analysis/
      • iLEAPP Mobile Container Manager Logs Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/mobileContainerManager.py
    • /root/Library/MobileContainerManager/containers.sqlite3
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Application Groups & Shared data
        • http://www.swiftforensics.com/2021/01/ios-application-groups-shared-data.html
    • /root/Library/Preferences/com.apple.MobileBackup.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • Using Apple “Bug Reporting” for forensic purposes
        • https://for585.com/sysdiagnose
      • Sysdiagnose in iOS 16: a first look from a Digital Forensics perspective
        • https://blog.digital-forensics.it/2022/11/sysdiagnose-in-ios-16-first-look-from.html
      • iOS Sysdiagnose Mobile Backup script
        • https://github.com/cheeky4n6monkey/iOS_sysdiagnose_forensic_scripts/blob/master/sysdiagnose-mobilebackup.py
      • Local Photo Library Photos.sqlite Query Documentation & Notable Artifacts
        • https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts/
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /root/Library/Preferences/com.apple.preferences.network.plist
      • Artifacts of an IOS device
        • https://infosecaddicts.com/artifacts-ios-device/
      • Wireless Network Preferences – iOS
        • https://bitsplease4n6.wordpress.com/2020/12/17/wireless-network-preferences-ios/

    "/wireless/" folder

    • /wireless/Library/Databases/CellularUsage.db
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • A Few Interesting iOS Forensic Artefacts
        • https://salt4n6.com/2018/05/15/a-few-interesting-ios-forensic-artefacts/
      • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
        • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
      • Cellebrite CTF 2021 - Marsha's Backup
        • https://www.stark4n6.com/2021/10/cellebrite-ctf-2021-marshas-backup.html
      • iOS Analysis Test No. 20-5551 Summary Report
        • https://cts-forensics.com/reports/20-5551_Web.pdf
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
    • /wireless/Library/Databases/DataUsage.sqlite
      • Network and Application Usage using netusage.sqlite & DataUsage.sqlite iOS Databases
        • http://www.mac4n6.com/blog/2019/1/6/network-and-application-usage-using-netusagesqlite-amp-datausagesqlite-ios-databases
      • FROM APPLE SEEDS TO APPLE PIE
        • https://objectivebythesea.org/v1/talks/OBTS_v1_Edwards.pdf
      • iOS - Tracking Traces of Deleted Applications
        • https://blog.d204n6.com/2019/09/ios-tracking-traces-of-deleted.html
      • Tracking Traces of Deleted Applications - SANS DFIR Summit 2019
        • https://www.youtube.com/watch?v=4LcQm4ErXpA
      • iOS Analysis Test No. 20-5551 Summary Report
        • https://cts-forensics.com/reports/20-5551_Web.pdf
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
        • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
      • iOS Forensics: HFS+ file system, partitions and relevant evidences
        • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
      • APOLLO DataUsage Modules
        • https://github.com/mac4n6/APOLLO/blob/master/modules/datausage_zprocess.txt https://github.com/mac4n6/APOLLO/blob/master/modules/datausage_zliveusage.txt
      • iLEAPP DataUsage Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/netusage.py
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083
    • /wireless/Library/preferences/com.apple.commcenter.callservices.plist
    • /wireless/Library/Preferences/com.apple.commcenter.counts.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • /wireless/Library/Preferences/com.apple.commcenter.data.plist
      • Mo’ SIMs, Mo’ Problems. Examining Phones with Dual SIMs.
        • https://thebinaryhick.blog/2022/12/06/mo-sims-mo-problems-examining-phones-with-dual-sims/
      • iLEAPP SimInfo Plugin
        • https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/simInfo.py
    • /wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
    • /wireless/Library/Preferences/com.apple.commcenter.plist
      • Checkra1n Era - Ep 4 - Analyzing extractions "Before First Unlock"
        • https://blog.digital-forensics.it/2019/12/checkra1n-era-ep-4-analyzing.html
      • iOS Forensics: HFS+ file system, partitions and relevant evidences
        • https://andreafortuna.org/2020/08/31/ios-forensics-hfs-file-system-partitions-and-relevant-evidences/
      • iOS Forensics: BFU (Before First Unlock) acquisition, using checkra1n
        • https://andreafortuna.org/2020/01/10/ios-forensics-bfu-before-first-unlock-acquisition-using-checkra1n/
      • Artifacts of an IOS device
        • https://infosecaddicts.com/artifacts-ios-device/
      • iOS Analysis Test No. 18-5551 Summary Report
        • https://cts-forensics.com/reports/38551_Web.pdf
      • iOS Analysis Test No. 21-5551 Summary Report
        • https://cts-forensics.com/reports/21-5551_Web.pdf
      • iOS Analysis Test No. 22-5551 Summary Report
        • https://cts-forensics.com/reports/22-5551_Web.pdf
      • Practical Mobile Forensics - Fourth Edition
        • https://www.packtpub.com/product/practical-mobile-forensics-fourth-edition/9781838647520
      • iOS Forensics for Investigators
        • https://www.packtpub.com/product/ios-forensics-for-investigators/9781803234083

    ← Metadata

    172
    Stars
    20
    Forks
    Watchers

    Owner

    verified publisher icon RealityNet

    Metadata

    A curated list of iOS Forensics References, organized by folder with specific references (links to blog post, research paper, articles, and so on) for each interesting file

    Back