Getting Started with iOS Forensics

iOS (iPhone OS) Forensics

iOS is a mobile Operating System that is developed by Apple Inc. It is the OS that is a part of most of the applications developed by the company that includes iPhone, iPad, and iPod. It has the file system HSFX to store and manage the database. The key to successful iPhone forensics is analysis of data and converting it to useful evidence

Understanding iPhone Time-Stamps

There are two types of timestamps that an iPhone use. While using the tools for forensics purpose, the examiner has to ensure that the tools convert the timestamp properly. If there is access to the raw SQLite files, then the timestamps can be manually verified.

Unix Timestamp: The epoch time of Unix gets started from 1st January 1970. The Unix Timestamp is the number of seconds that offsets the epoch.

Mac Absolute Time: The Mac epoch time starts from 1ST January 2001. There is a difference of 978, 307, 200 seconds between the Mac and Unix epoch.

Logical Acquisition of iOS Device's Data

For forensics of iOS device the logical acquisition of data is require which could reveal the Phone secrets. The data stored in iPhone, iPad & iPod is in SQLite format. SQLite is a database engine of SQL (Structured Query Language) that is an open source. It is transactional in nature and does not require any set-up, installation, configuration files, or administration. This server less database management system is a popular DB format on various mobile platforms.

Like other smart phones in the market, iPhone also makes heavy use of SQLite for storing its database like calendar, messages, notes, phone information etc. Moreover, third party applications that are installed on iOS (For example: Whatsapp, Skype) also use SQLite database to store their data.

The SQLite database is stored in single disk file which may or may not have file extension. Usually, you will find the database saved with .db or sqlitedb file extension but this can vary also vary (according to the application that uses the SQLite).

Address Book Contacts

The address book will contain all personal contact information of the user, except for those from the third party application. This will get saved into the Home Domain file that will be available following location:

'private/var/mobile/library/ addressbook /addressbook.sqlitedb'

When the addressbook.sqlitedb file is further explored in a SQLite browser, three tables will give suitable information to the examiner:

• ABPerson: Details like name, notes, and organization gets saved into this table.
• ABMultiValue: The extended information from the ABPerson table like email address, phone numbers, Website URL etc. will be saved here. The ABMultiValue table uses a file named record_id that is linked with the row_id file of ABPerson table.
• ABMultiValueTable: The labels that will help to identify the information that is saved in the ABMultiValue table.

Call History

Received, Dialed, or Missed call details of iPhone gets saved into SQLite database along with the metadata like date, time, day, call duration, etc. This information gets saved into WirelessDomain file at:

'private/var/wireless/Library/CallHistory/call_history.db'

In this file, details of only 100 calls will be stored (collaboratively received, dialed, and missed) and the older entries will be removed from the records. However, these records can still be recovered from the free SQLite space through manual hex examination.

In the call_history.db file, there will be a table named "call" that will have information about phone number of the other party, the duration for call (in seconds), the UNIX timestamp of when the conversation initiated, the mobile country code etc. This table will also has status flag that helps to identify the call type.

• Flag (16) - FaceTime call
• Flag (5) – Outgoing Call
• Flag (4) – Incoming Call
• Flag (8) – Blocked Call
• Flag (-1) – For Unknown Contact

SMS Messages

The multimedia messages that are sent from or to the phone along with relation information like date, time, number of the remote party etc. From iOS 5, the iMessage data gets saved into the SMS database only. iMessage is a proprietary service by Apple that allows sending text, multimedia messages, audios, videos from one iOS device to another. This database gets saved into the Home Domain at:

'private/var/mobile/Library/SMS/call_history.db'

SMS Spotlight Cache

The SMS data of iOS is indexed in a database so that it can be quickly searched. This Spotlight is a search feature that is used for the entire device. The Spotlight Cache database gets saved into Home Domain at:

'private/var/mobile/Library/Spotlight/com.apple.MobileSMS/SMSSearchIndex.sqlite'

Safari Bookmarks/Web Cache

In Safari browser, the user is allowed to bookmark important websites on machine. This database will be saved into Home Domain at:

'private/var/mobile/Library/Safari/Bookmarks.db'

While the recently downloaded and cached data gets saved at:

'private/var/mobile/Library/Caches/com.apple.mobilesafari/cache.db'.

Metadata of Photos

The detailed information of photos stored in the photo album in iOS gets saved in SQLite database at:

'private/var/mobile/library/ addressbook /addressbook.sqlitedb'

Consolidated GPS Cache

The geolocation history of the device is saved in any of the following databases:

Private/var/root/Caches/location/ consolidated.db

Private/var/root/Caches/location/ cache_encryptedA.db

These database files are the part of Root Domain. The information about the cell towers that were close to device or the Wi-Fi networks that were available for connection will be saved in this files.

E-Mail Database

The email database of applications get saved into SQLite database in the Home Domain. The database is saved with no extension and is saved at:

'private/var/mobile/Library/Mail/Protected Index'

Note: The attachments will be saved at Mail directory.

What is the Current trending Solution to iOS Forensics Services

For viewing the data in SQLite databases, there are free applications available online. However, particularly for forensically examining the database (opening, data recovery, reporting etc.) applications like SQLite Forensics Explorer have been in the market for help.

Download the utility & then fiollow the below mentioned steps to get the desired results.

Download Now

Step-1. Launch the Software & Click on the Add File option.

Step-2.Browse & Add History DB file of the iOS device for example.

Step-3.After scanning, preview the database without any hassles.

Step-4.Click on the Hex tab to check the Hex value of the records.

Step-5.Go to the Deleted tab to look at the deleted data from the SQLite file.

Step-6. Click on PDF or CSV icon to export the data in these file formats for further forensics analysis.

The Conclusion

Apart from the above features, the automated utility allow users to search for any data records using the SQLite commands. In a nutshell, there are plenty of other solutions availavble as well for digital forensics investigation of an iOS device. However, when it comes particularly to the SQlite files analysis, this solution is so far the best we have.