O'Reilly logo

Practical Mobile Forensics by Heather Mahalik, Rohit Tamma, Satish Bommisetty

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Other important files

Apart from SQLite and plist files, several other locations may contain valuable information to an investigation.

The others sources include the following:

  • Cookies
  • Keyboard cache
  • Photos
  • Wallpaper
  • Snapshots
  • Recordings
  • Downloaded applications

Cookies

Cookies can be recovered from /private/var/mobile/Library/Cookies/Cookies.binarycookies. This file is a standard binary file that contains cookies saved when web pages are accessed on the device. This information can be a good indication of what websites the user has been actively visiting.

To convert the binary cookie to human readable format, run the BinaryCookieReader.py Python script on the cookie file, as shown in the following command. The Python script source code is available in the ...

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, interactive tutorials, and more.

Start Free Trial

No credit card required