January 2018
Beginner to intermediate
402 pages
10h 6m
English
Apple relies on SQLite and Plist as common locations for application data storage. On occasion, JSON files will be used for application data. Examining applications recovered from an iOS device can be overwhelming. We suggest you start with what you know and what your tool is telling you. Examine the Installed Applications listed by your tool of choice. From here, go directly to the applications directory and ensure that nothing is being overlooked. When a user deletes an app, the databases often remain and the link to the installed application is simply broken. Examining all areas of the iOS device will prevent the examiner from missing data:
After examining the installed applications, ...
Read now
Unlock full access