iOS 15 Image Forensics Analysis and Tools Comparison - Communication and Social Networking Apps
The fourth episode is dedicated to the most analyzed family of applications: communication and social networking apps.
Before I start, I would like to mention that I have
made some corrections to the previous blog post, based on feedback by tool
developers. Also, most of them have confirmed to me that they are working on
improving their parsing capabilities, based on this blog series. I am happy to
support them in that direction!
There are 29 communication and social
networking applications available in Josh Hickman’s acquisition.
The apps are listed below, in alphabetical order.
- BeReal
- Burner
- Clubhouse
- Discord
- Facebook Messenger
- Google Chat
- Google Meet
- Google Voice
- GroupMe
- imoHD
- Kik Messenger
- Line
- Mastodon
- MeWe
- Session
- Signal
- Silent Phone
- Skype
- Snapchat
- Telegram
- Threema
- TikTok
- Truth Social
- Viber
- Wickr Pro
- Wire
Before getting into the details of every single
apps, it’s important to highlight that once an app is installed on an iOS
device, app data is stored in a subfolder in the
/private/var/mobile/Containers/Data/Application/ folder. Some apps can also
store data in a subfolder in the
/private/var/mobile/Containers/Shared/AppGroup. When analyzing an application,
it’s important to check and eventually investigate both areas.
APOLLO has no parsers for third-party apps and ArtEx
only has a parser for Discord, which did not run correctly on the test image,
and a parser for Snapchat.
Each section for each app is structured
similarly: first, a list of the most important files and folders is provided,
then a description of the tools parsing capabilities for that app, and finally
two different tables. The first table provides the details for each action
documented by Josh in the iOS 15 image documentation, and the second table provides
a summary of the tools’ parsing capabilities based on the test results.
As usual, YES means that the value was parsed and parsed correctly, NO means that the value was not parsed, YELLOW means that it was partially parsed, and BLUE means that the value was found elsewhere (i.e., iOS Notification or iOS Cache).
BeReal
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-RelationshipsContactsManager-contact
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-RelationshipsFriendsListManager
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-UploadPostWorker-post-upload
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-FeedMyPostManager-subject-series
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/AlexisBarreyat.BeReal/fsCachedData
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/AlexisBarreyat.BeReal/Cache.db
Direct parsing of this application is only supported by OXYGEN, but it only includes account information, contacts, posts, and cache. AXIOM, PA, XAMN, and iLEAPP were able to parse a comment to a post from iOS notifications. BeReal parsing was introduced by PA in version 7.64.
Following is the comparison table with the details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
05/05/2023 |
12:10 |
16:10 |
Set profile picture |
HAL |
NO |
NO |
NO |
NO |
NO |
NO |
|
17/05/2023 |
08:27 |
12:27 |
Took & Posted BeReal |
Starbucks/car selfie |
NO |
NO |
NO |
NO |
NO |
NO |
|
18/05/2023 |
15:02 |
19:02 |
Took & Posted BeReal |
Car doors |
NO |
NO |
NO |
NO |
NO |
NO |
|
18/05/2023 |
15:03 |
19:03 |
Left comment on other BeReal |
Nice machine! |
NO |
NO |
NO |
NO |
NO |
NO |
|
18/05/2023 |
15:07 |
19:07 |
Other party commented on BeReal |
(BeReal posted at 15:02) Car doors??? |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
20/05/2023 |
13:43 |
17:43 |
Took BeReal & discarded it |
|
NO |
NO |
NO |
NO |
NO |
NO |
|
20/05/2023 |
13:44 |
17:44 |
Took BeReal |
Trees & playground |
NO |
NO |
NO |
NO |
NO |
NO |
|
20/05/2023 |
13:45 |
17:45 |
Sent BeReal |
(Taken at 13:44) |
NO |
NO |
NO |
NO |
NO |
NO |
The overall results for each category and tool are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
NO |
YES |
NO |
NO |
NO |
|
Contacts |
NO |
NO |
YES |
NO |
NO |
NO |
|
Posts |
NO |
NO |
YES |
NO |
NO |
NO |
|
Cache |
NO |
NO |
YES |
NO |
NO |
NO |
Burner
Relevant information for this application is stored in these files and folders:
- /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Phoenix.sqlite
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/fsCachedData/
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/Cache.db
Direct parsing of this application is supported by AXIOM and OXYGEN. PA, XAMN, and iLEAPP were able to parse some incoming messages from iOS notifications. Messages and contacts are parsed correctly by both AXIOM and OXYGEN. Audio calls are partially parsed by both tools, as they were not able to determine the call length.
Following is the comparison table with the details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
08/05/2023 |
13:23 |
17:23 |
Obtained phone number |
|
NO |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:25 |
17:25 |
Sent message |
You there? |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:27 |
17:27 |
Received message |
I am. What number is this? |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
13:29 |
17:29 |
Sent message |
Burner. What are you doing? |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:33 |
17:33 |
Received message |
Ah, ok. Nothing in particular. Same as you. |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
13:37 |
17:37 |
Sent message |
Catching up on some DS9. I can’t believe I never
watched that when it was on-air |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:46 |
17:46 |
Received message |
It’s a good show. Helps in understanding Picard |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
13:48 |
17:48 |
Sent message |
That’s what I have heard. Definitely an
underrated show. |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:49 |
17:49 |
Received message |
It is. Hang on and I’ll send you a picture |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
13:50 |
17:50 |
Received picture |
Pirate |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:52 |
17:52 |
Sent message |
Got it. I’ll send one |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:53 |
17:53 |
Sent picture |
An intelligent man |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:54 |
17:54 |
Received message |
Got it. I’ll call you in a minute. |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:55 |
17:55 |
Outgoing audio call |
(~1:30) |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:58 |
17:58 |
Sent message |
Ok. We got that backwards. You can call me now.
Lol |
YES |
NO |
YES |
NO |
NO |
NO |
|
08/05/2023 |
13:59 |
17:59 |
Incoming audio call |
(0:13) (iOS call logs shows accepted call, Burner
call log shows as missed call) |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
14:00 |
18:00 |
Incoming audio call |
(0:15) (iOS call logs shows accepted call, Burner
call log shows as missed call) |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
08/05/2023 |
14:01 |
18:01 |
Received voicemail |
(0:09) |
YES |
NO |
YES |
NO |
NO |
NO |
The overall results for each category and tool are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
NO |
YES |
NO |
NO |
NO |
|
Contacts |
YES |
NO |
YES |
NO |
NO |
NO |
|
Messages |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
Calls |
YES |
Notifications |
YES |
Notifications |
NO |
Notifications |
|
Voicemail |
YES |
NO |
YES |
NO |
NO |
NO |
|
Attachments |
NO |
NO |
Cache |
NO |
NO |
NO |
|
Cache |
NO |
NO |
YES |
NO |
NO |
NO |
Clubhouse
Relevant information for this application is stored in these files and folders:
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/co.alphaexploration.clubhouse.plist
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/co.alphaexploration.clubhouse/csCachedData
Direct parsing of this application is supported
by PA and OXYGEN, but messages were not parsed. AXIOM, PA, XAMN, and iLEAPP were able to parse
some incoming messages from iOS notifications.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
05/05/2023 |
12:19 |
16:19 |
Login |
Login |
NO |
NO |
NO |
NO |
NO |
NO |
|
05/05/2023 |
12:21 |
16:21 |
Received message |
Made it to Clubhouse. |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
05/05/2023 |
12:22 |
16:22 |
Sent message |
Awesome. Welcome back. |
NO |
NO |
NO |
NO |
NO |
NO |
|
05/05/2023 |
12:23 |
16:23 |
Received message |
Thanks. This looks rather limited, eh? |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
05/05/2023 |
12:24 |
16:24 |
Sent message |
It does. WE can try to create a room in a few
minutes. |
NO |
NO |
NO |
NO |
NO |
NO |
|
05/05/2023 |
12:26 |
16:26 |
Received message |
Sounds good. We can’t even send photos here, can
we? |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
05/05/2023 |
12:28 |
16:28 |
Sent message |
Nope. Basic DMs. |
NO |
NO |
NO |
NO |
NO |
NO |
|
05/05/2023 |
12:29 |
16:29 |
Received message |
I’ll create the room. Give me a moment. |
NO |
NO |
NO |
NO |
NO |
NO |
|
05/05/2023 |
12:30 |
16:30 |
Entered room |
(~1:30) |
NO |
NO |
NO |
NO |
NO |
NO |
The overall results for each category and tool
are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
NO |
YES |
NO |
NO |
NO |
|
Contacts |
NO |
NO |
YES |
NO |
NO |
NO |
|
Channels / Rooms |
NO |
NO |
YES |
NO |
NO |
NO |
|
Messages |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
Cache |
NO |
NO |
YES |
NO |
NO |
NO |
Discord
Relevant information for this application is
stored in these files and folders:
- /private/var/mobile/Containers/Data/Application/<GUID>/Documents/mmkv/mmkv.default
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.hammerandchisel.discord/Cache.db
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/fsCachedData/
Direct parsing of this application is supported
by AXIOM, PA, OXYGEN, XAMN, and iLEAPP. Some differences were found in parsing
capabilities. The deleted message was not recovered by any of the tested
tools.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
24/04/2023 |
14:09 |
18:09 |
Sent message |
I know it says “Android Test Images,” but can we
use this server? |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:10 |
18:10 |
Received message |
Sure, I don’t see why not. What are you up to? |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:12 |
18:12 |
Sent message |
Not much. Just sitting here generating data.
Seems that’s my thing. Lol. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:13 |
18:13 |
Received message |
You could do worse. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:14 |
18:14 |
Sent message |
True. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:15 |
18:15 |
Received message |
How’s the phone? |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:16 |
18:16 |
Sent message |
Still cracked. I still can’t believe I dropped it
like that. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:17 |
18:17 |
Received message |
That was painful to watch. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:20 |
18:20 |
Sent message |
Here comes a picture |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:21 |
18:21 |
Sent picture |
Emotet |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:22 |
18:22 |
Received message |
Accurate! I’ll send one. Hang on. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
14:23 |
18:23 |
Received picture |
Ransomware operator |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:23 |
20:23 |
Sent message |
DM’s? |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:24 |
20:24 |
Other party reacted |
Reaction to message sent at 16:23 (thumbs up
emoji) |
NO |
NO |
NO |
NO |
NO |
NO |
|
24/04/2023 |
16:25 |
20:25 |
Received message |
You here? |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:27 |
20:27 |
Sent message |
I am. Hang on and I’ll send a picture. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:28 |
20:28 |
Sent picture |
Cat |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:29 |
20:29 |
Received message |
I’ll send one. Give me a minute. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:31 |
20:31 |
Received picture |
ChatGPT |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:33 |
20:33 |
Sent message |
I will audio call you in just a minute. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:34 |
20:34 |
Outgoing audio call |
(~1:21) |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:36 |
20:36 |
Incoming audio call |
(~1:31) |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:38 |
20:38 |
Received message |
There was your audio call |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:39 |
20:39 |
Sent message |
I will video call you in a moment |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:40 |
20:40 |
Outgoing video call |
(~1:30) |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:42 |
20:42 |
Received message |
I will video call you momentarily |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:43 |
20:43 |
Incoming video call |
(~1:30) |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:45 |
20:45 |
Received message |
Please delete this message when you get it. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:46 |
20:46 |
Sent message |
I can only delete messages I send |
NO |
NO |
NO |
NO |
NO |
NO |
|
24/04/2023 |
16:47 |
20:47 |
Received message |
Then delete that one. |
YES |
YES |
NO |
YES |
NO |
YES |
|
24/04/2023 |
16:48 |
20:48 |
Deleted message |
(Message sent at 16:46) |
NO |
NO |
NO |
NO |
NO |
NO |
|
24/04/2023 |
16:49 |
20:49 |
Sent message |
Deleted. |
YES |
YES |
NO |
YES |
NO |
YES |
The overall results for each category and tool are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
YES |
YES |
YES |
NO |
YES |
|
Contacts |
NO |
YES |
YES |
YES |
NO |
NO |
|
Messages |
YES |
YES |
NO |
YES |
NO |
YES |
|
Deleted message |
NO |
NO |
NO |
NO |
NO |
NO |
|
Calls |
YES |
YES |
NO |
YES |
NO |
YES |
|
Servers |
NO |
NO |
YES |
NO |
NO |
NO |
|
Cache |
NO |
NO |
YES |
YES |
NO |
NO |
Facebook Messenger
Relevant information for this application is
stored in these files:
- /private/var/mobile/Containers/Shared/AppGroup/<GUID>/Library/Application Support/lightspeed-userDatabases/<User_ID>.db
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/com.facebook.Messenger.plist
Direct parsing of this application is supported
by all tested tools.
Some differences were found in parsing capabilities. The deleted message was
recovered from the SQLite database by most of the tools.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
Type |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
25/04/2023 |
13:47 |
17:47 |
Sent message |
You here? |
Normal chat |
NO |
NO |
NO |
NO |
NO |
NO |
|
25/04/2023 |
13:48 |
17:48 |
Received message |
You know it |
Normal chat |
Notifications |
Notifications |
NO |
Notifications |
NO |
Notifications |
|
25/04/2023 |
13:49 |
17:49 |
Sent message |
Awesome. Let’s make this quick, shall we? We also
have secure chat to do. |
Normal chat |
NO |
NO |
NO |
NO |
NO |
NO |
|
25/04/2023 |
13:51 |
17:51 |
Received message |
Sounds good to me. Do you even have any pictures
to send? Lol. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
Notifications |
|
25/04/2023 |
13:52 |
17:52 |
Sent message |
Not much. I need to download a few. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
13:53 |
17:53 |
Received message |
I figured as much. Imgur is a good app. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
Notifications |
|
25/04/2023 |
13:54 |
17:54 |
Sent message |
I’ll look at it later. Here comes a picture. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
13:56 |
17:56 |
Sent picture |
YouTuber |
Normal chat |
NO |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
13:57 |
17:57 |
Received message |
Nice. I’ll send one. Give me a moment. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
Notifications |
|
25/04/2023 |
13:59 |
17:59 |
Received picture |
Free tacos |
Normal chat |
NO |
YES |
NO |
YES |
NO |
NO |
|
25/04/2023 |
14:01 |
18:01 |
Sent message |
Lol. I will call you in a minute. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:01 |
18:01 |
Other party liked message |
(Message sent 14:01 - heart emoji) |
Normal chat |
NO |
NO |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:02 |
18:02 |
Outgoing audio call |
Call failed |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:02 |
18:02 |
Incoming audio call |
(~1:20) |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:04 |
18:04 |
Sent message |
Ok. I’ll try to call you again. Lol. |
Normal chat |
YES |
YES |
YES |
YES |
YES |
YES |
|
25/04/2023 |
14:05 |
18:05 |
Outgoing audio call |
(~1:30) |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:07 |
18:07 |
Received message |
Here comes a video call. |
Normal chat |
YES |
YES |
YES |
YES |
YES |
YES |
|
25/04/2023 |
14:08 |
18:08 |
Incoming video call |
Call failed |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:08 |
18:08 |
Outgoing video call |
(~1:30) |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:10 |
18:10 |
Sent message |
Want to try again? |
Normal chat |
YES |
YES |
YES |
YES |
YES |
YES |
|
25/04/2023 |
14:12 |
18:12 |
Incoming video call |
(~1:30) |
Normal chat |
YES |
YES |
NO |
YES |
YES |
NO |
|
25/04/2023 |
14:14 |
18:14 |
Received message |
I’m over in secure chat now. |
Secure chat |
Notifications |
YES |
NO |
Notifications |
NO |
Notifications |
|
25/04/2023 |
14:15 |
18:15 |
Sent message |
Same. Send me a picture please. |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:16 |
18:16 |
Received picture |
A criminal |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:18 |
18:18 |
Sent message |
Nice. I will send you one. Hang on. |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:19 |
18:19 |
Sent picture |
Task failed successfully |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:20 |
18:20 |
Received message |
I will audio call you |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:21 |
18:21 |
Liked message |
(Message received at 14:20 – heart emoji) |
Secure chat |
NO |
NO |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:22 |
18:22 |
Incoming audio call |
(~1:40) |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:24 |
18:24 |
Sent message |
I will audio call you now. |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:25 |
18:25 |
Outgoing audio call |
(~1:35) |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
14:28 |
18:28 |
Received message |
I will video call you after I get back. |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:04 |
21:04 |
Incoming video call |
(~1:30) |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:06 |
21:06 |
Sent message |
I will video call you in a minute. |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:07 |
21:07 |
Outgoing video call |
(~1:30) |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:09 |
21:09 |
Sent message |
I will delete this message momentarily. |
Secure chat |
NO |
NO |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:10 |
21:10 |
Unsent message |
(message sent at 17:09) |
Secure chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
25/04/2023 |
17:11 |
21:11 |
Received message |
Please delete this message when you get it. |
Normal chat |
YES |
YES |
NO |
YES |
YES |
Notifications |
|
25/04/2023 |
17:12 |
21:12 |
Removed message |
(message received at 17:11) |
Normal chat |
YES |
YES |
YES |
YES |
YES |
NO |
|
25/04/2023 |
17:13 |
21:13 |
Sent message |
I removed it. |
Normal chat |
YES |
YES |
YES |
YES |
YES |
YES |
|
25/04/2023 |
11:36 |
15:36 |
Sent static location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
NO |
|
17/05/2023 |
11:43 |
15:43 |
Received static location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
NO |
|
17/05/2023 |
11:48 |
15:48 |
Started sending dynamic location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
YES |
|
17/05/2023 |
11:53 |
15:53 |
Stopped sending dynamic location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
NO |
|
17/05/2023 |
11:56 |
15:56 |
Started receiving dynamic location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
YES |
|
17/05/2023 |
12:01 |
16:01 |
Stopped sending dynamic location |
|
Normal chat |
YES |
YES |
YES |
YES |
NO |
NO |
The overall results for each category and tool
are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
YES |
YES |
YES |
NO |
NO |
|
Contacts |
NO |
YES |
YES |
YES |
YES |
NO |
|
Chat |
YES |
YES |
YES |
YES |
YES |
NO |
|
Secure Chat |
NO |
YES |
NO |
NO |
NO |
NO |
|
Deleted message |
YES |
YES |
NO |
YES |
YES |
NO |
|
Calls |
YES |
YES |
NO |
YES |
NO |
YES |
|
Static Location |
YES |
YES |
YES |
YES |
NO |
NO |
|
Dynamic Location |
YES |
YES |
YES |
YES |
NO |
YES |
Google Chat
Relevant information for this application is
stored in an SQLite database:
- /private/var/mobile/Containers/Data/Application/<GUID>/Documents/user_accounts/<USER_ID>/dynamite.db
Direct parsing of this application is supported
by OXYGEN and BELKASOFT. AXIOM, PA, XAMN, and iLEAPP were able to parse some incoming messages
from iOS notifications.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
26/04/2023 |
12:28 |
16:28 |
Received message |
In Google Chat. You here? |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:30 |
16:30 |
Sent message |
I am. My better is dying. This poor phone |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:31 |
16:31 |
Sent message |
My battery is dying*** |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:32 |
16:32 |
Received message |
Lol. I figured that is what you meant. |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:33 |
16:33 |
Sent message |
Let’s make this quick. Here comes a picture |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:37 |
16:37 |
Sent picture |
Your PC |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:38 |
16:38 |
Other party reacted |
(ROFL emoji) |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:39 |
16:39 |
Received message |
Got it. I’ll send you one |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:40 |
16:40 |
Received picture |
Team of 1980 |
Notifications |
Notifications |
NO |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:42 |
16:42 |
Sent message |
I’ll make a new group. Give me a few minutes |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:44 |
16:44 |
Created space |
iOS 15 Test Space / added DFIR Two to space |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:45 |
16:45 |
Sent message |
You here? |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:46 |
16:46 |
Received message |
I am. How’s the battery doing? |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:47 |
16:47 |
Sent message |
Not great. (Smiley face emoji) |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:49 |
16:49 |
Received message |
No calls on this app? |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:50 |
16:50 |
Sent message |
Doesn’t appear so. I’ll send a picture. Hang on. |
NO |
NO |
YES |
NO |
YES |
NO |
|
26/04/2023 |
12:52 |
16:52 |
Sent picture |
Chickens |
NO |
NO |
NO |
NO |
YES |
NO |
|
26/04/2023 |
12:53 |
16:53 |
Received message |
Got it. I’ll send one now |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
26/04/2023 |
12:54 |
16:54 |
Received picture |
The shower |
Notifications |
Notifications |
NO |
Notifications |
YES |
Notifications |
The overall results for each category and tool
are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
NO |
NO |
YES |
NO |
YES |
NO |
|
Contacts |
NO |
NO |
YES |
NO |
YES |
NO |
|
Groups Chat Info |
NO |
NO |
YES |
NO |
YES |
NO |
|
Messages |
Notifications |
Notifications |
YES |
Notifications |
YES |
Notifications |
|
Cache |
NO |
NO |
YES |
NO |
NO |
NO |
|
Message reactions |
NO |
NO |
YES |
NO |
NO |
NO |
Google Meet
Relevant information for this application is
stored in these files:
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Application Support/DataStore
- /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/com.google.Tachyon.plist
Direct parsing of this application is supported
by AXIOM, OXYGEN, XAMN, and iLEAPP. PA parsed some calls from the native call history.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
26/04/2023 |
11:11 |
15:11 |
Outgoing video call |
(1:20) |
YES |
YES |
YES |
YES |
NO |
YES |
|
26/04/2023 |
11:14 |
15:14 |
Incoming video call |
(1:31) |
YES |
YES |
YES |
YES |
NO |
YES |
|
26/04/2023 |
11:17 |
15:17 |
Outgoing audio call |
(1:30) |
YES |
YES |
YES |
YES |
NO |
YES |
|
26/04/2023 |
11:20 |
15:20 |
Incoming audio call |
(1:35) |
YES |
YES |
YES |
YES |
NO |
YES |
|
26/04/2023 |
11:23 |
15:23 |
Received note |
I am sending you this note. |
YES |
NO |
YES |
YES |
NO |
YES |
|
26/04/2023 |
11:27 |
15:27 |
Sent note |
Note received. Here is your note. |
YES |
NO |
YES |
YES |
NO |
YES |
The overall results for each category and tool
are shown in the following table.
|
|
AXIOM |
PA |
OXYGEN |
XAMN |
BELKASOFT |
ILEAPP |
|
Account Information |
YES |
NO |
YES |
YES |
NO |
NO |
|
Contacts |
YES |
NO |
YES |
YES |
NO |
YES |
|
Calls |
YES |
YES |
YES |
YES |
NO |
YES |
|
Notes |
YES |
NO |
YES |
YES |
NO |
YES |
Google Voice
Relevant information for this application is
stored in these files:
- /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/voiceClientSettings
- /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/threadingStore.sqlite
Direct parsing of this application is only
supported by OXYGEN.
AXIOM, PA, XAMN, and iLEAPP extracted some incoming messages from iOS
notifications, including the deleted one.
Following is the comparison table with the
details of each action documented by Josh in the creation of the image.
|
Date |
Time (EDT) |
Time (UTC) |
Action |
Message |
AXIOM |
PA |
OXYGEN |
XAMN |