±Partners and Sponsors

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 1
New Yesterday: 7
Overall: 26224
Visitors: 65

±Forensics Europe Expo


±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

PList and .db Files

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

PList and .db Files

Post Posted: Tue Jan 07, 2014 12:30 am

I recently had a locked iPhone 5 that I sent off to Apple with a search warrant for assistance in retrieving the files from the phone. After a few months, they sent the device back and a thumb drive with the recovered files, all of which is in .db and PList files. I do not have a lot of experience with these files. I was able to pull up the .db files with MPE, but I have yet to find any software that can convert these into any type of acceptable reporting format.

Does anyone know of anything that can import these into a semi-usable reporting format for court? I have heard OFS2013 has a viewer and offers some reporting features, but I do not have access to that software. Anything FREE or affordable that I could sell to the PD would be great!

Thanks in advance for any help you can provide!  

jhowe
Newbie
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 4:40 am

- jhowe
I recently had a locked iPhone 5 that I sent off to Apple with a search warrant for assistance in retrieving the files from the phone. After a few months, they sent the device back and a thumb drive with the recovered files, all of which is in .db and PList files. I do not have a lot of experience with these files. I was able to pull up the .db files with MPE, but I have yet to find any software that can convert these into any type of acceptable reporting format.

Does anyone know of anything that can import these into a semi-usable reporting format for court? I have heard OFS2013 has a viewer and offers some reporting features, but I do not have access to that software. Anything FREE or affordable that I could sell to the PD would be great!

Thanks in advance for any help you can provide!


You can open up/analyse/export (csv format) SQLite database files with:
www.sqliteexpert.com/

There is a free Expert Personal version, or alternatively you can have the Professional version (which there is a 30 day trial of) or you can purchase the professional version for cheap $

OR try out sourceforge.net/projec...tebrowser/

Also, with a quick search on this form, this looks interesting:
www.forensicfocus.com/...ht=sqlite/

For further info on PList and SQLite check out:
www.appleexaminer.com/...PLIST.html

Hope this helps Cool  

DCS1094
Senior Member
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 4:48 am

Thanks a lot. That's some good info and a good place to start  

jhowe
Newbie
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 9:43 am

Katana forensics makes a product called Lantern that parses the files returned from Apple very well and produces a nice report.

Eric  

EBWahlberg
Member
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 1:29 pm

I would echo DCS1094's comments, those are very good SQLite browsers and you should be able to highlight and drag and drop a bunch of the databases into SQLite Expert to view multiple DB's quickly.

Our software, IEF, can also parse individual DB files from iOS/Android devices by using the "File Dump" option, and may save you some time. If you have IEF and need instructions or don't have IEF and would like a trial, please feel free to reach out to me directly at jad(at)magnetforensics(dot)com.

Good luck!
Jad  

MagnetForensics
Member
 
 
  

Re: PList and .db Files

Post Posted: Thu Jan 09, 2014 7:23 pm

To view the Property List Files on a Windows machine you may want to look at Plist Editor for Windows

www.icopybot.com/download.htm

There is a freeware and a pro version.

Regards,

Chris Currier  

nlpd120
Senior Member
 
 
  

Re: PList and .db Files

Post Posted: Fri Jan 10, 2014 7:42 am

Why not use Cellebrite UFED to analyze the phones. Just played around with my personnel iP5 and if you get the passcode problem sorted out Cellebrite UFED Analyzer is a very nice tool to have an overview/ detailed data in a sorted way. You also have access to the file system itself to do some further stuff.  

Bitstorm
Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 2
Go to page 1, 2  Next