Practical Mobile Forensics - Fourth Edition

iOS applications

Apple relies on SQLite and Plist as common locations for application data storage. On occasion, JSON files will be used for application data. Examining applications recovered from an iOS device can be overwhelming. We suggest you start with what you know and what your tool is telling you. Examine the Installed Applications listed by your tool of choice. From here, go directly to the applications directory and ensure that nothing is being overlooked. When a user deletes an app, the databases often remain and the link to the installed application is simply broken. Examining all areas of the iOS device will prevent you from missing data:

Installed applications on an iPhone

After examining the installed applications, search ...