iOS 15 Image Forensics Analysis and Tools Comparison - Communication and Social Networking Apps

The fourth episode is dedicated to the most analyzed family of applications: communication and social networking apps.

Before I start, I would like to mention that I have made some corrections to the previous blog post, based on feedback by tool developers. Also, most of them have confirmed to me that they are working on improving their parsing capabilities, based on this blog series. I am happy to support them in that direction!

There are 29 communication and social networking applications available in Josh Hickman’s acquisition. 

The apps are listed below, in alphabetical order.

  1. BeReal
  2. Burner
  3. Clubhouse
  4. Discord
  5. Facebook Messenger
  6. Google Chat
  7. Google Meet
  8. Google Voice
  9. GroupMe
  10. imoHD
  11. Instagram
  12. Kik Messenger
  13. Line
  14. Mastodon
  15. MeWe
  16. Session
  17. Signal
  18. Silent Phone
  19. Skype
  20. Snapchat
  21. Telegram
  22. Threema
  23. TikTok
  24. Truth Social
  25. Twitter
  26. Viber
  27. WhatsApp
  28. Wickr Pro
  29. Wire

Before getting into the details of every single apps, it’s important to highlight that once an app is installed on an iOS device, app data is stored in a subfolder in the /private/var/mobile/Containers/Data/Application/ folder. Some apps can also store data in a subfolder in the /private/var/mobile/Containers/Shared/AppGroup. When analyzing an application, it’s important to check and eventually investigate both areas.  

APOLLO has no parsers for third-party apps and ArtEx only has a parser for Discord, which did not run correctly on the test image, and a parser for Snapchat.

Each section for each app is structured similarly: first, a list of the most important files and folders is provided, then a description of the tools parsing capabilities for that app, and finally two different tables. The first table provides the details for each action documented by Josh in the iOS 15 image documentation, and the second table provides a summary of the tools’ parsing capabilities based on the test results.

As usual, YES means that the value was parsed and parsed correctly, NO means that the value was not parsed, YELLOW means that it was partially parsed, and BLUE means that the value was found elsewhere (i.e., iOS Notification or iOS Cache).

BeReal

Relevant information for this application is stored in these files and folders:

  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-RelationshipsContactsManager-contact
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-RelationshipsFriendsListManager
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-UploadPostWorker-post-upload
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/disk-bereal-FeedMyPostManager-subject-series
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/AlexisBarreyat.BeReal/fsCachedData
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/AlexisBarreyat.BeReal/Cache.db

Direct parsing of this application is only supported by OXYGEN, but it only includes account information, contacts, posts, and cache. AXIOM, PA, XAMN, and iLEAPP were able to parse a comment to a post from iOS notifications. BeReal parsing was introduced by PA in version 7.64.

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

05/05/2023

12:10

16:10

Set profile picture

HAL

NO

NO

NO

NO

NO

NO

17/05/2023

08:27

12:27

Took & Posted BeReal

Starbucks/car selfie

NO

NO

NO

NO

NO

NO

18/05/2023

15:02

19:02

Took & Posted BeReal

Car doors

NO

NO

NO

NO

NO

NO

18/05/2023

15:03

19:03

Left comment on other BeReal

Nice machine!

NO

NO

NO

NO

NO

NO

18/05/2023

15:07

19:07

Other party commented on BeReal

(BeReal posted at 15:02) Car doors???

Notifications

Notifications

NO

Notifications

NO

Notifications

20/05/2023

13:43

17:43

Took BeReal & discarded it

 

NO

NO

NO

NO

NO

NO

20/05/2023

13:44

17:44

Took BeReal

Trees & playground

NO

NO

NO

NO

NO

NO

20/05/2023

13:45

17:45

Sent BeReal

(Taken at 13:44)

NO

NO

NO

NO

NO

NO

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

NO

YES

NO

NO

NO

Contacts

NO

NO

YES

NO

NO

NO

Posts

NO

NO

YES

NO

NO

NO

Cache

NO

NO

YES

NO

NO

NO

Burner

Relevant information for this application is stored in these files and folders:

  • /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Phoenix.sqlite
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/fsCachedData/
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/Cache.db

Direct parsing of this application is supported by AXIOM and OXYGEN. PA, XAMN, and iLEAPP were able to parse some incoming messages from iOS notifications. Messages and contacts are parsed correctly by both AXIOM and OXYGEN. Audio calls are partially parsed by both tools, as they were not able to determine the call length.

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

08/05/2023

13:23

17:23

Obtained phone number

 

NO

NO

YES

NO

NO

NO

08/05/2023

13:25

17:25

Sent message

You there?

YES

NO

YES

NO

NO

NO

08/05/2023

13:27

17:27

Received message

I am. What number is this?

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

13:29

17:29

Sent message

Burner. What are you doing?

YES

NO

YES

NO

NO

NO

08/05/2023

13:33

17:33

Received message

Ah, ok. Nothing in particular. Same as you.

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

13:37

17:37

Sent message

Catching up on some DS9. I can’t believe I never watched that when it was on-air

YES

NO

YES

NO

NO

NO

08/05/2023

13:46

17:46

Received message

It’s a good show. Helps in understanding Picard

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

13:48

17:48

Sent message

That’s what I have heard. Definitely an underrated show.

YES

NO

YES

NO

NO

NO

08/05/2023

13:49

17:49

Received message

It is. Hang on and I’ll send you a picture

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

13:50

17:50

Received picture

Pirate

YES

NO

YES

NO

NO

NO

08/05/2023

13:52

17:52

Sent message

Got it. I’ll send one

YES

NO

YES

NO

NO

NO

08/05/2023

13:53

17:53

Sent picture

An intelligent man

YES

NO

YES

NO

NO

NO

08/05/2023

13:54

17:54

Received message

Got it. I’ll call you in a minute.

YES

NO

YES

NO

NO

NO

08/05/2023

13:55

17:55

Outgoing audio call

(~1:30)

YES

NO

YES

NO

NO

NO

08/05/2023

13:58

17:58

Sent message

Ok. We got that backwards. You can call me now. Lol

YES

NO

YES

NO

NO

NO

08/05/2023

13:59

17:59

Incoming audio call

(0:13) (iOS call logs shows accepted call, Burner call log shows as missed call)

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

14:00

18:00

Incoming audio call

(0:15) (iOS call logs shows accepted call, Burner call log shows as missed call)

YES

Notifications

YES

Notifications

NO

Notifications

08/05/2023

14:01

18:01

Received voicemail

(0:09)

YES

NO

YES

NO

NO

NO

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

NO

YES

NO

NO

NO

Contacts

YES

NO

YES

NO

NO

NO

Messages

YES

Notifications

YES

Notifications

NO

Notifications

Calls

YES

Notifications

YES

Notifications

NO

Notifications

Voicemail

YES

NO

YES

NO

NO

NO

Attachments

NO

NO

Cache

NO

NO

NO

Cache

NO

NO

YES

NO

NO

NO

Clubhouse

Relevant information for this application is stored in these files and folders:

  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/co.alphaexploration.clubhouse.plist
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/co.alphaexploration.clubhouse/csCachedData

Direct parsing of this application is supported by PA and OXYGEN, but messages were not parsed. AXIOM, PA, XAMN, and iLEAPP were able to parse some incoming messages from iOS notifications.

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

05/05/2023

12:19

16:19

Login

Login

NO

NO

NO

NO

NO

NO

05/05/2023

12:21

16:21

Received message

Made it to Clubhouse.

Notifications

Notifications

NO

Notifications

NO

Notifications

05/05/2023

12:22

16:22

Sent message

Awesome. Welcome back.

NO

NO

NO

NO

NO

NO

05/05/2023

12:23

16:23

Received message

Thanks. This looks rather limited, eh?

Notifications

Notifications

NO

Notifications

NO

Notifications

05/05/2023

12:24

16:24

Sent message

It does. WE can try to create a room in a few minutes.

NO

NO

NO

NO

NO

NO

05/05/2023

12:26

16:26

Received message

Sounds good. We can’t even send photos here, can we?

Notifications

Notifications

NO

Notifications

NO

Notifications

05/05/2023

12:28

16:28

Sent message

Nope. Basic DMs.

NO

NO

NO

NO

NO

NO

05/05/2023

12:29

16:29

Received message

I’ll create the room. Give me a moment.

NO

NO

NO

NO

NO

NO

05/05/2023

12:30

16:30

Entered room

(~1:30)

NO

NO

NO

NO

NO

NO

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

NO

YES

NO

NO

NO

Contacts

NO

NO

YES

NO

NO

NO

Channels / Rooms

NO

NO

YES

NO

NO

NO

Messages

Notifications

Notifications

NO

Notifications

NO

Notifications

Cache

NO

NO

YES

NO

NO

NO

Discord

Relevant information for this application is stored in these files and folders:

  • /private/var/mobile/Containers/Data/Application/<GUID>/Documents/mmkv/mmkv.default
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.hammerandchisel.discord/Cache.db
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Caches/com.adhoclabs.burner/fsCachedData/

Direct parsing of this application is supported by AXIOM, PA, OXYGEN, XAMN, and iLEAPP. Some differences were found in parsing capabilities. The deleted message was not recovered by any of the tested tools.

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

24/04/2023

14:09

18:09

Sent message

I know it says “Android Test Images,” but can we use this server?

YES

YES

NO

YES

NO

YES

24/04/2023

14:10

18:10

Received message

Sure, I don’t see why not. What are you up to?

YES

YES

NO

YES

NO

YES

24/04/2023

14:12

18:12

Sent message

Not much. Just sitting here generating data. Seems that’s my thing. Lol.

YES

YES

NO

YES

NO

YES

24/04/2023

14:13

18:13

Received message

You could do worse.

YES

YES

NO

YES

NO

YES

24/04/2023

14:14

18:14

Sent message

True.

YES

YES

NO

YES

NO

YES

24/04/2023

14:15

18:15

Received message

How’s the phone?

YES

YES

NO

YES

NO

YES

24/04/2023

14:16

18:16

Sent message

Still cracked. I still can’t believe I dropped it like that.

YES

YES

NO

YES

NO

YES

24/04/2023

14:17

18:17

Received message

That was painful to watch.

YES

YES

NO

YES

NO

YES

24/04/2023

14:20

18:20

Sent message

Here comes a picture

YES

YES

NO

YES

NO

YES

24/04/2023

14:21

18:21

Sent picture

Emotet

YES

YES

NO

YES

NO

YES

24/04/2023

14:22

18:22

Received message

Accurate! I’ll send one. Hang on.

YES

YES

NO

YES

NO

YES

24/04/2023

14:23

18:23

Received picture

Ransomware operator

YES

YES

NO

YES

NO

YES

24/04/2023

16:23

20:23

Sent message

DM’s?

YES

YES

NO

YES

NO

YES

24/04/2023

16:24

20:24

Other party reacted

Reaction to message sent at 16:23 (thumbs up emoji)

NO

NO

NO

NO

NO

NO

24/04/2023

16:25

20:25

Received message

You here?

YES

YES

NO

YES

NO

YES

24/04/2023

16:27

20:27

Sent message

I am. Hang on and I’ll send a picture.

YES

YES

NO

YES

NO

YES

24/04/2023

16:28

20:28

Sent picture

Cat

YES

YES

NO

YES

NO

YES

24/04/2023

16:29

20:29

Received message

I’ll send one. Give me a minute.

YES

YES

NO

YES

NO

YES

24/04/2023

16:31

20:31

Received picture

ChatGPT

YES

YES

NO

YES

NO

YES

24/04/2023

16:33

20:33

Sent message

I will audio call you in just a minute.

YES

YES

NO

YES

NO

YES

24/04/2023

16:34

20:34

Outgoing audio call

(~1:21)

YES

YES

NO

YES

NO

YES

24/04/2023

16:36

20:36

Incoming audio call

(~1:31)

YES

YES

NO

YES

NO

YES

24/04/2023

16:38

20:38

Received message

There was your audio call

YES

YES

NO

YES

NO

YES

24/04/2023

16:39

20:39

Sent message

I will video call you in a moment

YES

YES

NO

YES

NO

YES

24/04/2023

16:40

20:40

Outgoing video call

(~1:30)

YES

YES

NO

YES

NO

YES

24/04/2023

16:42

20:42

Received message

I will video call you momentarily

YES

YES

NO

YES

NO

YES

24/04/2023

16:43

20:43

Incoming video call

(~1:30)

YES

YES

NO

YES

NO

YES

24/04/2023

16:45

20:45

Received message

Please delete this message when you get it.

YES

YES

NO

YES

NO

YES

24/04/2023

16:46

20:46

Sent message

I can only delete messages I send

NO

NO

NO

NO

NO

NO

24/04/2023

16:47

20:47

Received message

Then delete that one.

YES

YES

NO

YES

NO

YES

24/04/2023

16:48

20:48

Deleted message

(Message sent at 16:46)

NO

NO

NO

NO

NO

NO

24/04/2023

16:49

20:49

Sent message

Deleted.

YES

YES

NO

YES

NO

YES

 The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

YES

YES

YES

NO

YES

Contacts

NO

YES

YES

YES

NO

NO

Messages

YES

YES

NO

YES

NO

YES

Deleted message

NO

NO

NO

NO

NO

NO

Calls

YES

YES

NO

YES

NO

YES

Servers

NO

NO

YES

NO

NO

NO

Cache

NO

NO

YES

YES

NO

NO

Facebook Messenger

Relevant information for this application is stored in these files:

  • /private/var/mobile/Containers/Shared/AppGroup/<GUID>/Library/Application Support/lightspeed-userDatabases/<User_ID>.db
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/com.facebook.Messenger.plist

Direct parsing of this application is supported by all tested tools. Some differences were found in parsing capabilities. The deleted message was recovered from the SQLite database by most of the tools.

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

Type

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

25/04/2023

13:47

17:47

Sent message

You here?

Normal chat

NO

NO

NO

NO

NO

NO

25/04/2023

13:48

17:48

Received message

You know it

Normal chat

Notifications

Notifications

NO

Notifications

NO

Notifications

25/04/2023

13:49

17:49

Sent message

Awesome. Let’s make this quick, shall we? We also have secure chat to do.

Normal chat

NO

NO

NO

NO

NO

NO

25/04/2023

13:51

17:51

Received message

Sounds good to me. Do you even have any pictures to send? Lol.

Normal chat

YES

YES

NO

YES

YES

Notifications

25/04/2023

13:52

17:52

Sent message

Not much. I need to download a few.

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

13:53

17:53

Received message

I figured as much. Imgur is a good app.

Normal chat

YES

YES

NO

YES

YES

Notifications

25/04/2023

13:54

17:54

Sent message

I’ll look at it later. Here comes a picture.

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

13:56

17:56

Sent picture

YouTuber

Normal chat

NO

YES

NO

YES

YES

NO

25/04/2023

13:57

17:57

Received message

Nice. I’ll send one. Give me a moment.

Normal chat

YES

YES

NO

YES

YES

Notifications

25/04/2023

13:59

17:59

Received picture

Free tacos

Normal chat

NO

YES

NO

YES

NO

NO

25/04/2023

14:01

18:01

Sent message

Lol. I will call you in a minute.

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:01

18:01

Other party liked message

(Message sent 14:01 - heart emoji)

Normal chat

NO

NO

NO

NO

NO

NO

25/04/2023

14:02

18:02

Outgoing audio call

Call failed

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:02

18:02

Incoming audio call

(~1:20)

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:04

18:04

Sent message

Ok. I’ll try to call you again. Lol.

Normal chat

YES

YES

YES

YES

YES

YES

25/04/2023

14:05

18:05

Outgoing audio call

(~1:30)

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:07

18:07

Received message

Here comes a video call.

Normal chat

YES

YES

YES

YES

YES

YES

25/04/2023

14:08

18:08

Incoming video call

Call failed

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:08

18:08

Outgoing video call

(~1:30)

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:10

18:10

Sent message

Want to try again?

Normal chat

YES

YES

YES

YES

YES

YES

25/04/2023

14:12

18:12

Incoming video call

(~1:30)

Normal chat

YES

YES

NO

YES

YES

NO

25/04/2023

14:14

18:14

Received message

I’m over in secure chat now.

Secure chat

Notifications

YES

NO

Notifications

NO

Notifications

25/04/2023

14:15

18:15

Sent message

Same. Send me a picture please.

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:16

18:16

Received picture

A criminal

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:18

18:18

Sent message

Nice. I will send you one. Hang on.

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:19

18:19

Sent picture

Task failed successfully

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:20

18:20

Received message

I will audio call you

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:21

18:21

Liked message

(Message received at 14:20 – heart emoji)

Secure chat

NO

NO

NO

NO

NO

NO

25/04/2023

14:22

18:22

Incoming audio call

(~1:40)

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:24

18:24

Sent message

I will audio call you now.

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:25

18:25

Outgoing audio call

(~1:35)

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

14:28

18:28

Received message

I will video call you after I get back.

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

17:04

21:04

Incoming video call

(~1:30)

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

17:06

21:06

Sent message

I will video call you in a minute.

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

17:07

21:07

Outgoing video call

(~1:30)

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

17:09

21:09

Sent message

I will delete this message momentarily.

Secure chat

NO

NO

NO

NO

NO

NO

25/04/2023

17:10

21:10

Unsent message

(message sent at 17:09)

Secure chat

NO

YES

NO

NO

NO

NO

25/04/2023

17:11

21:11

Received message

Please delete this message when you get it.

Normal chat

YES

YES

NO

YES

YES

Notifications

25/04/2023

17:12

21:12

Removed message

(message received at 17:11)

Normal chat

YES

YES

YES

YES

YES

NO

25/04/2023

17:13

21:13

Sent message

I removed it.

Normal chat

YES

YES

YES

YES

YES

YES

25/04/2023

11:36

15:36

Sent static location

 

Normal chat

YES

YES

YES

YES

NO

NO

17/05/2023

11:43

15:43

Received static location

 

Normal chat

YES

YES

YES

YES

NO

NO

17/05/2023

11:48

15:48

Started sending dynamic location

 

Normal chat

YES

YES

YES

YES

NO

YES

17/05/2023

11:53

15:53

Stopped sending dynamic location

 

Normal chat

YES

YES

YES

YES

NO

NO

17/05/2023

11:56

15:56

Started receiving dynamic location

 

Normal chat

YES

YES

YES

YES

NO

YES

17/05/2023

12:01

16:01

Stopped sending dynamic location

 

Normal chat

YES

YES

YES

YES

NO

NO

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

YES

YES

YES

NO

NO

Contacts

NO

YES

YES

YES

YES

NO

Chat

YES

YES

YES

YES

YES

NO

Secure Chat

NO

YES

NO

NO

NO

NO

Deleted message

YES

YES

NO

YES

YES

NO

Calls

YES

YES

NO

YES

NO

YES

Static Location

YES

YES

YES

YES

NO

NO

Dynamic Location

YES

YES

YES

YES

NO

YES

Google Chat

Relevant information for this application is stored in an SQLite database:

  • /private/var/mobile/Containers/Data/Application/<GUID>/Documents/user_accounts/<USER_ID>/dynamite.db

Direct parsing of this application is supported by OXYGEN and BELKASOFT. AXIOM, PA, XAMN, and iLEAPP were able to parse some incoming messages from iOS notifications.  

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

26/04/2023

12:28

16:28

Received message

In Google Chat. You here?

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:30

16:30

Sent message

I am. My better is dying. This poor phone

NO

NO

YES

NO

YES

NO

26/04/2023

12:31

16:31

Sent message

My battery is dying***

NO

NO

YES

NO

YES

NO

26/04/2023

12:32

16:32

Received message

Lol. I figured that is what you meant.

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:33

16:33

Sent message

Let’s make this quick. Here comes a picture

NO

NO

YES

NO

YES

NO

26/04/2023

12:37

16:37

Sent picture

Your PC

NO

NO

YES

NO

YES

NO

26/04/2023

12:38

16:38

Other party reacted

(ROFL emoji)

NO

NO

YES

NO

YES

NO

26/04/2023

12:39

16:39

Received message

Got it. I’ll send you one

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:40

16:40

Received picture

Team of 1980

Notifications

Notifications

NO

Notifications

YES

Notifications

26/04/2023

12:42

16:42

Sent message

I’ll make a new group. Give me a few minutes

NO

NO

YES

NO

YES

NO

26/04/2023

12:44

16:44

Created space

iOS 15 Test Space / added DFIR Two to space

NO

NO

YES

NO

YES

NO

26/04/2023

12:45

16:45

Sent message

You here?

NO

NO

YES

NO

YES

NO

26/04/2023

12:46

16:46

Received message

I am. How’s the battery doing?

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:47

16:47

Sent message

Not great. (Smiley face emoji)

NO

NO

YES

NO

YES

NO

26/04/2023

12:49

16:49

Received message

No calls on this app?

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:50

16:50

Sent message

Doesn’t appear so. I’ll send a picture. Hang on.

NO

NO

YES

NO

YES

NO

26/04/2023

12:52

16:52

Sent picture

Chickens

NO

NO

NO

NO

YES

NO

26/04/2023

12:53

16:53

Received message

Got it. I’ll send one now

Notifications

Notifications

YES

Notifications

YES

Notifications

26/04/2023

12:54

16:54

Received picture

The shower

Notifications

Notifications

NO

Notifications

YES

Notifications

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

NO

NO

YES

NO

YES

NO

Contacts

NO

NO

YES

NO

YES

NO

Groups Chat Info

NO

NO

YES

NO

YES

NO

Messages

Notifications

Notifications

YES

Notifications

YES

Notifications

Cache

NO

NO

YES

NO

NO

NO

Message reactions

NO

NO

YES

NO

NO

NO

Google Meet

Relevant information for this application is stored in these files:

  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Application Support/DataStore
  • /private/var/mobile/Containers/Data/Application/<GUID>/Library/Preferences/com.google.Tachyon.plist

Direct parsing of this application is supported by AXIOM, OXYGEN, XAMN, and iLEAPP. PA parsed some calls from the native call history. 

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

26/04/2023

11:11

15:11

Outgoing video call

(1:20)

YES

YES

YES

YES

NO

YES

26/04/2023

11:14

15:14

Incoming video call

(1:31)

YES

YES

YES

YES

NO

YES

26/04/2023

11:17

15:17

Outgoing audio call

(1:30)

YES

YES

YES

YES

NO

YES

26/04/2023

11:20

15:20

Incoming audio call

(1:35)

YES

YES

YES

YES

NO

YES

26/04/2023

11:23

15:23

Received note

I am sending you this note.

YES

NO

YES

YES

NO

YES

26/04/2023

11:27

15:27

Sent note

Note received. Here is your note.

YES

NO

YES

YES

NO

YES

The overall results for each category and tool are shown in the following table.

 

AXIOM

PA

OXYGEN

XAMN

BELKASOFT

ILEAPP

Account Information

YES

NO

YES

YES

NO

NO

Contacts

YES

NO

YES

YES

NO

YES

Calls

YES

YES

YES

YES

NO

YES

Notes

YES

NO

YES

YES

NO

YES

Google Voice

Relevant information for this application is stored in these files:

  • /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/voiceClientSettings
  • /private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/threadingStore.sqlite

Direct parsing of this application is only supported by OXYGEN. AXIOM, PA, XAMN, and iLEAPP extracted some incoming messages from iOS notifications, including the deleted one. 

Following is the comparison table with the details of each action documented by Josh in the creation of the image.

Date

Time (EDT)

Time (UTC)

Action

Message

AXIOM

PA

OXYGEN

XAMN