January 2018
Beginner to intermediate
402 pages
10h 6m
English
book
Practical Mobile Forensics - Third Edition
by Rohit Tamma, Oleg Skulkin, Heather Mahalik, Satish Bommisetty
Content preview from Practical Mobile Forensics - Third Edition
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
Start your free trial
Keyboard cache
The keyboard cache is captured and saved in the dynamic-text.dat file. This file is located at /private/var/mobile/Library/Keyboard/dynamic-text.dat and contains the keyboard cache, which is comprised of text entered by the user. This text is cached as part of the device's autocorrect feature, and it was designed to autocomplete the predictive common words as well as cache words typed by the user on the device. The file keeps a list of approximately 600 words per language that are used on the iOS device. Commonly, this file is the only source of the artifact should the data be inaccessible, encrypted, or permanently deleted from the iOS device.
The dynamic-text.dat is a binary file, and it can be viewed using a hex editor. ...