Alireza Gharib Blog

It is important to clarify one aspect of the
research: I only considered “parsed data”. Using a tool that has
in-content search capabilities or special file viewers, you could manually
search for the information. But that’s outside the scope of this investigation:
I want to check which information is parsed by which tool, and whether it was
parsed as expected. To check and validate the non-parsed values, I searched for
the expected value among the parsed data (a kind of backward search).

It is possible that I missed something, so I
ask people and vendors to check my results. I am happy to correct and update
the following tables.

Let’s start with the general information about
the device. I have organised this section into 6 subsections:

• Hardware
  information
• iOS
  and SIM card information
• iOS
  wipe and setup
• iOS
  basic settings
• Apple
  Account(s)
• Installed
  applications

As for the hardware information, I
identified that once in the table as relevant. The first column contains a
description of the content, the second column contains the expected value, and
the third column contains the source of the information, that is, the file
containing the information.

When analyzing the data parsed by the tools, I
found that none of the tools did incorrect parsing, but then again, none of the
tools parsed everything either. APOLLO, which is intended more as a tool for
advanced analysis, does not have parsers for basic device information. It is
important to highlight that some values are in some way redundant (model number
and internal name) and are equivalent for their scope, while other values are
specific and peculiar to the device and therefore should rather be extracted (e.g.
serial number or UDID). It’s relevant to clarify that, through testing, I verified that MSAB XRY/XAMN can extract and parse also Model Internal Name and Bluetooth Mac Address. The results for each value and tool are shown in the
figure, where YES means that the value was parsed and parsed correctly, and NO
means that the value was not parsed.

As for software and SIM card information,
I identified the once in the table as relevant. The first column contains a
description of the content, the second column contains the expected value, and
the third column contains the source of the information, i.e., the file
containing the information.

The parsing results for each tool are shown in
the figure. When it comes to the ICCID it’s import to highlight that iLEAPP
only parse the com.apple.commcenter.plist, while others parse also the CellularUsage.db, containing
historical information about SIM card used on the device. An interesting value
that is parsed only by AXIOM and iLEAPP is the DSID (https://www.theiphonewiki.com/wiki/DSID ) while the Airdrop ID is parsed only Cellebrite, Oxygen and ArtEx.

As for device wiping and setup, I
identified the once in the table as relevant. The first column contains a
description of the content and the second column contains the source of the
information, i.e., the file containing the information.

Two tools (Cellebrite PA and ArtEx) analyzed
and reported the wiping time as April 11th, 2023 14:44:31 UTC using the
timestamp of the .obliterated file (the traditional old method), while ArtEx
also reports April 11th, 2023 14:44:50 UTC using the containermanager.log.0 file
as confirmation. XAMN reports April 11th 023 14:44:54 UTC from the general.log file.

The traditional method and manual analysis
confirmed and validated the timestamps:

• Keybagd.log.3
  has the first entry on Tue Apr 11 14:44:32 2023
• Mobile_installation.log.1 has this entry “Tue Apr 11 07:45:45 2023 [206] (0x16f72b000)
  MIIsBuildUpgrade: The latest build information was not found; we need to
  upgrade from before 8.0 or this is a delete installation”, where the
  timestamp is in the Cupertino time zone
• Lockdownd.log
  has this entry “04/11/23 07:44:51.388024 pid=76 _load_dict: Failed to load
  /private/var/root/Library/Lockdown/data_ark.plist.”, where the timestamp is in
  the Cupertino time zone

AXIOM did not report a wiping time, but
analyzed and reported the device setup timestamp (April 15th 2023
13:59:16), while iLEAPP did not report a deletion time, but analyzed the device
backup restore timestamp (April 15rh 2023 14:08:21). Belkasoft did not analyze
this information.

As for device settings, I identified the
ones in the table as relevant. The first column contains a description of the
content, the second column contains the expected value, and the third column
contains the source of the information, i.e., the file containing the
information.

Some of the relevant settings were parsed only
by some tools, as indicated in the table. Among others, the time zone setting
is important to match timestamps, and the date of the last backup is important
to decide whether it is worth looking for this backup (locally or in the iCloud). It’s relevant to clarify that, through testing, I verified that MSAB XRY/XAMN can extract and parse Timezone and Last Backup Date/Time.  

All the tools correctly identified the Apple
account on the device, and all of them parsed the Accounts3.sqlite file at some
level, providing different amounts of information. The following table lists
the information parsed by each of the tools for Apple accounts.

The approach used by tools to search for
installed applications is quite different. Most of them rely on the applicationstate.db
file to generate the list of installed applications, while some of them integrates
this analysis with additional sources, such as:

• the
  IconState.plist, available at privatevarmobileLibrarySpringBoardIconState.plist
  and containing iOS Home Screen Item
• the
  iTunesMetadata.plist and BundleMetadata.plist, both available in
  each Bundle folder.
• the
  .com.apple.mobile_container_manager.metdata.plist, available in the root
  folder of each App Container

All tested tools have a function to identify
application information and provide relevant information for analysis.

An important aspect of analyzing apps is
identifying permissions. If you know what permissions are granted, you can
prioritize your investigation. For example, if an application has access to
geolocation, it is worth investigating that app for traces of location; on the
other hand, if an app does not have access to geolocation, you will investigate
first other apps.

The TCC.db is parsed by AXIOM, XAMN,
APOLLO and iLEAPP. Apparently, it is not parsed by Cellebrite PA and Oxygen. All
tools report the bundle ID, the service (es. AddressBook, Calendar, Camera,
Liverpool, Microphone, Motion, Photos, PhotosAdd, Siri, Ubiquity, etc.) and
whether the permission was granted or not.

APOLLO and iLEAPP also reports the timestamp
when the user has granted or not granted permission, while AXIOM does not
display the timestamp, but does display the “prompt count,” which records
the number of times the user is prompted for permission on the user screen.
XAMN does not evaluate the timestamp and prompt count.

An interesting artifact related to applications
is the mobile_installation_log: It could be used to identify
installation and uninstallation activities and to define a time frame for the
usage of each application (see here for a detailed reference https://dfir.pubpub.org/pub/e5xlbw88/release/2).
This artifact is analyzed by AXIOM, BELKASOFT and iLEAPP: BELKASOFT analyzes
only the entries for successful installation, while AXIOM analyzes both
installation and uninstallation, and iLEAPP also analyzes the entries related
to a reboot of the device. In the figure you can see an excerpt from the mobile
installation logs parsed by iLEAPP.

As a last consideration, based on
available research and papers, what is still missing that apparently is not
parsed by any tool? I have at least two papers in mind, by Scott Koening.

• iOS Setting Display Auto-Lock and Require Password
• https://theforensicscooter.com/2021/09/05/ios-settings-display-auto-lock-require-passcode/
• https://dfir.pubpub.org/pub/khnqi0ff/release/1
• iOS Location Services and System Services are they ON or OFF
• https://theforensicscooter.com/2021/09/20/ios-location-services-and-system-services-on-or-off/
• https://dfir.pubpub.org/pub/4sv4kxyh/release/2

That’s all for this episode: see you soon with
the next one about native applications configuration and data!