MOBILE FORENSICS

Plain-text reference · 8 KB. Read it, search it (Ctrl-F) or print it.

Defensive / DFIR quick reference for iOS and Android. Blue-team only:
how to preserve a device, what you can acquire, where the artifacts
live, how to parse them. Get written consent/authority first; isolate
the device (airplane mode + Faraday bag) so it cannot be remote-wiped;
never alter the original - work on a hashed image/extraction. Exact
paths and tool support vary by OS version, device and lock state.

EVIDENCE HANDLING#

1. Authority/consent in writing BEFORE you touch the device
2. Photograph state; note if screen is on, locked, PIN known
3. Isolate radios: airplane mode AND a Faraday bag (stop remote wipe)
4. Keep it powered; a reboot can re-lock (BFU) and lose RAM/keys
5. Acquire, then hash the extraction (sha256); document chain of custody
# AFU (After First Unlock) vs BFU (Before First Unlock): far more data
# is decryptable in AFU, so keep the device unlocked-since-boot if legal.

ACQUISITION TYPES (least to most invasive)#

Logical      # backup / sync APIs (iTunes/Finder backup, adb) - partial
File system  # full app sandbox + DBs (needs agent/exploit/unlock)
Physical     # bit-for-bit flash image - rare on modern encrypted phones
Cloud        # iCloud / Google account data (separate legal authority)
# Modern iOS/Android encrypt storage with hardware keys, so a raw flash
# image without the passcode yields ciphertext - prefer logical/FS.

IOS: ACQUISITION#

# Encrypted local backup (set a backup password -> MORE data, incl.
# Keychain, Health). Via Finder/iTunes, or libimobiledevice:
ideviceinfo                          # device identity (UDID, iOS, model)
idevicepair pair                     # pairing (needs device unlocked)
idevicebackup2 -i encryption on      # turn ON encryption FIRST (-i prompts
                                     #   for the pwd; never pass it on CLI)
# WARNING: setting a backup password changes device state + persists,
# and fails if one is already set; an encrypted Manifest.db/backup can
# only be opened with that password - record it.
idevicebackup2 backup --full ./dest  # create a full backup to ./dest
# Richer, modern tooling (same lockdown/usbmux protocol):
pymobiledevice3 backup2 backup --full ./dest
pymobiledevice3 syslog live          # live device syslog stream
# MVT (mvt-ios) does consent-based backup/FS triage for spyware IOCs.
# Diagnostic bundle (logs, no user content): trigger sysdiagnose
# on-device (press both volume buttons + side button ~1s), then find it
# under Settings > Privacy & Security > Analytics & Improvements >
# Analytics Data (files named sysdiagnose_...).

IOS: BACKUP STRUCTURE + KEY ARTIFACTS#

# Backup location (one dir per device UDID):
~/Library/Application Support/MobileSync/Backup/<UDID>/   # macOS
%APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\        # Windows
# (Microsoft Store iTunes: %USERPROFILE%\Apple\MobileSync\Backup\)
#   Manifest.db   - SQLite: maps real paths <-> hashed backup filenames
#   Manifest.plist / Status.plist / Info.plist - backup metadata
# Files are stored under 2-char subdirs by SHA1 name; parse with a tool.
# Key SQLite databases (relative "domain" paths inside the backup):
HomeDomain/Library/SMS/sms.db                 # Messages / iMessage
HomeDomain/Library/CallHistoryDB/CallHistory.storedata   # calls
HomeDomain/Library/AddressBook/AddressBook.sqlitedb      # contacts
#   (newer iOS may use ContactsV2.sqlite instead)
HomeDomain/Library/Safari/History.db          # Safari browsing
CameraRollDomain/.../Photos.sqlite            # photo library metadata
WirelessDomain/.../DataUsage.sqlite           # per-app cellular usage
# Pattern-of-life artifacts - NOT in a normal backup; need a full
# file-system extraction (e.g. /private/var/mobile/Library/...):
#   knowledgeC.db, CurrentPowerlog.PLSQL, interactionC.db (parse with
#   APOLLO / iLEAPP), and Biome (iOS 16+; SEGB protobuf, not SQLite).
# Parse a whole extraction/backup with iLEAPP (reports -> HTML/SQLite).

IOS: LOGS#

idevicesyslog                        # live device syslog (libimobiledevice)
idevicecrashreport -e ./crash        # pull crash logs off the device
# The device unified log is inside a sysdiagnose (system_logs.logarchive),
# read it with:  log show system_logs.logarchive --predicate '...'

ANDROID: ACQUISITION#

# Footprint note: adb needs USB debugging already ON, and accepting the
# RSA key writes to the device - small but real; document it.
adb devices -l                       # confirm device + authorise RSA key
adb shell getprop ro.build.version.release   # Android version
adb shell getprop ro.product.model
# Logical pulls (no root): app PRIVATE data needs root or a FS image.
adb pull /sdcard/ ./sdcard           # user-accessible storage
adb shell dumpsys > dumpsys.txt      # huge service state snapshot
adb bugreport ./bugreport.zip        # logs + dumpsys + settings bundle
adb logcat -d > logcat.txt           # main/system/crash log buffers
# (kernel ring buffer is dmesg: adb shell dmesg / `su -c dmesg`)
# Note: `adb backup` is DEPRECATED (warning added ~2019); from Android
# 12 apps targeting API 31+ are excluded unless debuggable - so it
# captures little. Prefer a full FS image (vendor/forensic tool) or pulls.
# Rooted / FS image: copy /data (app sandboxes) + /data/system.

ANDROID: KEY ARTIFACTS (paths under /data)#

# System / accounts (app paths below = /data/data/<pkg>/, aka
# /data/user/0/<pkg>/):
/data/system/users/0/                        # user profile(s), per userId
/data/system/packages.xml                     # installed packages + perms
/data/system/users/0/settings_*.xml           # per-user settings
/data/misc/wifi/                              # saved Wi-Fi (<= Android 10)
/data/misc/apexdata/com.android.wifi/WifiConfigStore.xml  # Android 11+
# Android 12+: many system XML (settings, etc.) are ABX binary XML;
# convert with the on-device `abx2xml` before reading.
# Usage / pattern of life:
/data/system/usagestats/                      # app usage (UsageStatsManager)
# App content providers (SQLite):
.../com.android.providers.contacts/databases/contacts2.db   # contacts
.../com.android.providers.contacts/databases/calllog.db     # call log
#   (call log may instead sit in contacts2.db - check the `calls` table)
.../com.android.providers.telephony/databases/mmssms.db        # SMS/MMS
.../com.android.providers.media/databases/*.db                 # media index
# Common 3rd-party: WhatsApp .../msgstore.db (+ key); browsers store
# History in per-app SQLite. Parse an extraction with ALEAPP (-> report).

TIMESTAMP FORMATS (do not mis-date evidence)#

Unix epoch (s/ms)  # most Android DBs, many iOS cols (ms in some)
Mac absolute time  # iOS Cocoa/CoreData: seconds since 2001-01-01 UTC
                   # (knowledgeC ZSTARTDATE/ZENDDATE use this; sms.db
                   # `date` = nanoseconds since 2001 on iOS 11+)
Chrome/Chromium    # microseconds since 1601-01-01 (Chrome history;
                   # Safari History.db uses Mac absolute seconds)

ANALYSIS TOOLS#

# MVT (mvt-ios / mvt-android, Amnesty) - consent-based spyware/IOC
#   triage from a backup, FS dump or adb; checks against STIX2 IOCs.
# iLEAPP / ALEAPP (Alexis Brignoni) - parse iOS/Android extractions to
#   HTML + SQLite reports; cover most artifacts above. ALEAPP wants a
#   tar/zip/gz (repackage a folder dump first).
# APOLLO (mac4n6) - knowledgeC / powerlog pattern-of-life timeline.
# libimobiledevice + pymobiledevice3 - open-source iOS acquisition.
# Autopsy (+ mobile modules), plaso/log2timeline - super-timeline.
# Commercial (where licensed): Cellebrite, Magnet AXIOM, MSAB XRY.
# Always validate a tool's output against the raw DB for key findings.

REFERENCES#

# Apple Platform Security guide (Data Protection classes, backups)
# NIST SP 800-101r1 Guidelines on Mobile Device Forensics
# SANS FOR585 Smartphone Forensic Analysis In-Depth
# iLEAPP/ALEAPP: github.com/abrignoni ; MVT: docs.mvt.re (Amnesty)
# libimobiledevice: libimobiledevice.org ; pymobiledevice3 (doronz88)
# Android Debug Bridge (adb) + dumpsys: developer.android.com
# abx2xml (Android 12+ binary XML): AOSP frameworks/base/cmds/abx
# MITRE ATT&CK Mobile - adversary data-collection techniques to HUNT
#   for in these artifacts: T1636 (protected user data), T1430
#   (location), T1409 (stored app data), T1414 (clipboard)

MOBILE FORENSICS CHEAT SHEET
============================
Source: https://cyberramen.com


Defensive / DFIR quick reference for iOS and Android. Blue-team only:
how to preserve a device, what you can acquire, where the artifacts
live, how to parse them. Get written consent/authority first; isolate
the device (airplane mode + Faraday bag) so it cannot be remote-wiped;
never alter the original - work on a hashed image/extraction. Exact
paths and tool support vary by OS version, device and lock state.


EVIDENCE HANDLING
-----------------
1. Authority/consent in writing BEFORE you touch the device
2. Photograph state; note if screen is on, locked, PIN known
3. Isolate radios: airplane mode AND a Faraday bag (stop remote wipe)
4. Keep it powered; a reboot can re-lock (BFU) and lose RAM/keys
5. Acquire, then hash the extraction (sha256); document chain of custody
# AFU (After First Unlock) vs BFU (Before First Unlock): far more data
# is decryptable in AFU, so keep the device unlocked-since-boot if legal.


ACQUISITION TYPES (least to most invasive)
------------------------------------------
Logical      # backup / sync APIs (iTunes/Finder backup, adb) - partial
File system  # full app sandbox + DBs (needs agent/exploit/unlock)
Physical     # bit-for-bit flash image - rare on modern encrypted phones
Cloud        # iCloud / Google account data (separate legal authority)
# Modern iOS/Android encrypt storage with hardware keys, so a raw flash
# image without the passcode yields ciphertext - prefer logical/FS.


IOS: ACQUISITION
----------------
# Encrypted local backup (set a backup password -> MORE data, incl.
# Keychain, Health). Via Finder/iTunes, or libimobiledevice:
ideviceinfo                          # device identity (UDID, iOS, model)
idevicepair pair                     # pairing (needs device unlocked)
idevicebackup2 -i encryption on      # turn ON encryption FIRST (-i prompts
                                     #   for the pwd; never pass it on CLI)
# WARNING: setting a backup password changes device state + persists,
# and fails if one is already set; an encrypted Manifest.db/backup can
# only be opened with that password - record it.
idevicebackup2 backup --full ./dest  # create a full backup to ./dest
# Richer, modern tooling (same lockdown/usbmux protocol):
pymobiledevice3 backup2 backup --full ./dest
pymobiledevice3 syslog live          # live device syslog stream
# MVT (mvt-ios) does consent-based backup/FS triage for spyware IOCs.
# Diagnostic bundle (logs, no user content): trigger sysdiagnose
# on-device (press both volume buttons + side button ~1s), then find it
# under Settings > Privacy & Security > Analytics & Improvements >
# Analytics Data (files named sysdiagnose_...).


IOS: BACKUP STRUCTURE + KEY ARTIFACTS
-------------------------------------
# Backup location (one dir per device UDID):
~/Library/Application Support/MobileSync/Backup/<UDID>/   # macOS
%APPDATA%\Apple Computer\MobileSync\Backup\<UDID>\        # Windows
# (Microsoft Store iTunes: %USERPROFILE%\Apple\MobileSync\Backup\)
#   Manifest.db   - SQLite: maps real paths <-> hashed backup filenames
#   Manifest.plist / Status.plist / Info.plist - backup metadata
# Files are stored under 2-char subdirs by SHA1 name; parse with a tool.
# Key SQLite databases (relative "domain" paths inside the backup):
HomeDomain/Library/SMS/sms.db                 # Messages / iMessage
HomeDomain/Library/CallHistoryDB/CallHistory.storedata   # calls
HomeDomain/Library/AddressBook/AddressBook.sqlitedb      # contacts
#   (newer iOS may use ContactsV2.sqlite instead)
HomeDomain/Library/Safari/History.db          # Safari browsing
CameraRollDomain/.../Photos.sqlite            # photo library metadata
WirelessDomain/.../DataUsage.sqlite           # per-app cellular usage
# Pattern-of-life artifacts - NOT in a normal backup; need a full
# file-system extraction (e.g. /private/var/mobile/Library/...):
#   knowledgeC.db, CurrentPowerlog.PLSQL, interactionC.db (parse with
#   APOLLO / iLEAPP), and Biome (iOS 16+; SEGB protobuf, not SQLite).
# Parse a whole extraction/backup with iLEAPP (reports -> HTML/SQLite).


IOS: LOGS
---------
idevicesyslog                        # live device syslog (libimobiledevice)
idevicecrashreport -e ./crash        # pull crash logs off the device
# The device unified log is inside a sysdiagnose (system_logs.logarchive),
# read it with:  log show system_logs.logarchive --predicate '...'


ANDROID: ACQUISITION
--------------------
# Footprint note: adb needs USB debugging already ON, and accepting the
# RSA key writes to the device - small but real; document it.
adb devices -l                       # confirm device + authorise RSA key
adb shell getprop ro.build.version.release   # Android version
adb shell getprop ro.product.model
# Logical pulls (no root): app PRIVATE data needs root or a FS image.
adb pull /sdcard/ ./sdcard           # user-accessible storage
adb shell dumpsys > dumpsys.txt      # huge service state snapshot
adb bugreport ./bugreport.zip        # logs + dumpsys + settings bundle
adb logcat -d > logcat.txt           # main/system/crash log buffers
# (kernel ring buffer is dmesg: adb shell dmesg / `su -c dmesg`)
# Note: `adb backup` is DEPRECATED (warning added ~2019); from Android
# 12 apps targeting API 31+ are excluded unless debuggable - so it
# captures little. Prefer a full FS image (vendor/forensic tool) or pulls.
# Rooted / FS image: copy /data (app sandboxes) + /data/system.


ANDROID: KEY ARTIFACTS (paths under /data)
------------------------------------------
# System / accounts (app paths below = /data/data/<pkg>/, aka
# /data/user/0/<pkg>/):
/data/system/users/0/                        # user profile(s), per userId
/data/system/packages.xml                     # installed packages + perms
/data/system/users/0/settings_*.xml           # per-user settings
/data/misc/wifi/                              # saved Wi-Fi (<= Android 10)
/data/misc/apexdata/com.android.wifi/WifiConfigStore.xml  # Android 11+
# Android 12+: many system XML (settings, etc.) are ABX binary XML;
# convert with the on-device `abx2xml` before reading.
# Usage / pattern of life:
/data/system/usagestats/                      # app usage (UsageStatsManager)
# App content providers (SQLite):
.../com.android.providers.contacts/databases/contacts2.db   # contacts
.../com.android.providers.contacts/databases/calllog.db     # call log
#   (call log may instead sit in contacts2.db - check the `calls` table)
.../com.android.providers.telephony/databases/mmssms.db        # SMS/MMS
.../com.android.providers.media/databases/*.db                 # media index
# Common 3rd-party: WhatsApp .../msgstore.db (+ key); browsers store
# History in per-app SQLite. Parse an extraction with ALEAPP (-> report).


TIMESTAMP FORMATS (do not mis-date evidence)
--------------------------------------------
Unix epoch (s/ms)  # most Android DBs, many iOS cols (ms in some)
Mac absolute time  # iOS Cocoa/CoreData: seconds since 2001-01-01 UTC
                   # (knowledgeC ZSTARTDATE/ZENDDATE use this; sms.db
                   # `date` = nanoseconds since 2001 on iOS 11+)
Chrome/Chromium    # microseconds since 1601-01-01 (Chrome history;
                   # Safari History.db uses Mac absolute seconds)


ANALYSIS TOOLS
--------------
# MVT (mvt-ios / mvt-android, Amnesty) - consent-based spyware/IOC
#   triage from a backup, FS dump or adb; checks against STIX2 IOCs.
# iLEAPP / ALEAPP (Alexis Brignoni) - parse iOS/Android extractions to
#   HTML + SQLite reports; cover most artifacts above. ALEAPP wants a
#   tar/zip/gz (repackage a folder dump first).
# APOLLO (mac4n6) - knowledgeC / powerlog pattern-of-life timeline.
# libimobiledevice + pymobiledevice3 - open-source iOS acquisition.
# Autopsy (+ mobile modules), plaso/log2timeline - super-timeline.
# Commercial (where licensed): Cellebrite, Magnet AXIOM, MSAB XRY.
# Always validate a tool's output against the raw DB for key findings.


REFERENCES
----------
# Apple Platform Security guide (Data Protection classes, backups)
# NIST SP 800-101r1 Guidelines on Mobile Device Forensics
# SANS FOR585 Smartphone Forensic Analysis In-Depth
# iLEAPP/ALEAPP: github.com/abrignoni ; MVT: docs.mvt.re (Amnesty)
# libimobiledevice: libimobiledevice.org ; pymobiledevice3 (doronz88)
# Android Debug Bridge (adb) + dumpsys: developer.android.com
# abx2xml (Android 12+ binary XML): AOSP frameworks/base/cmds/abx
# MITRE ATT&CK Mobile - adversary data-collection techniques to HUNT
#   for in these artifacts: T1636 (protected user data), T1430
#   (location), T1409 (stored app data), T1414 (clipboard)

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.