Practical Mobile Forensics - Fourth Edition

Key artifacts – important iOS database files

Filesystems and backups that you extracted as per the instructions in Chapter 3, Data Acquisition from iOS Devices, and Chapter 4, Data Acquisition from iOS Backups, should contain the following SQLite databases that may be important to your investigation. If these files are not recovered, make sure that you acquired the iOS device correctly. The files that are shown in the following sections are extracted via logical acquisition from a device running iOS. As Apple adds new features to the built-in applications with every iOS release, the format of the files may vary for different iOS versions.