±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 33155
New Yesterday: 2 Visitors: 207

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

RSS Feed Widget

±Latest Webinars

PList and .db Files

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

PList and .db Files

Post Posted: Tue Jan 07, 2014 4:30 am

I recently had a locked iPhone 5 that I sent off to Apple with a search warrant for assistance in retrieving the files from the phone. After a few months, they sent the device back and a thumb drive with the recovered files, all of which is in .db and PList files. I do not have a lot of experience with these files. I was able to pull up the .db files with MPE, but I have yet to find any software that can convert these into any type of acceptable reporting format.

Does anyone know of anything that can import these into a semi-usable reporting format for court? I have heard OFS2013 has a viewer and offers some reporting features, but I do not have access to that software. Anything FREE or affordable that I could sell to the PD would be great!

Thanks in advance for any help you can provide!  

jhowe
Newbie
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 8:40 am

- jhowe
I recently had a locked iPhone 5 that I sent off to Apple with a search warrant for assistance in retrieving the files from the phone. After a few months, they sent the device back and a thumb drive with the recovered files, all of which is in .db and PList files. I do not have a lot of experience with these files. I was able to pull up the .db files with MPE, but I have yet to find any software that can convert these into any type of acceptable reporting format.

Does anyone know of anything that can import these into a semi-usable reporting format for court? I have heard OFS2013 has a viewer and offers some reporting features, but I do not have access to that software. Anything FREE or affordable that I could sell to the PD would be great!

Thanks in advance for any help you can provide!


You can open up/analyse/export (csv format) SQLite database files with:
www.sqliteexpert.com/

There is a free Expert Personal version, or alternatively you can have the Professional version (which there is a 30 day trial of) or you can purchase the professional version for cheap $

OR try out sourceforge.net/projec...tebrowser/

Also, with a quick search on this form, this looks interesting:
www.forensicfocus.com/...ht=sqlite/

For further info on PList and SQLite check out:
www.appleexaminer.com/...PLIST.html

Hope this helps Cool  

DCS1094
Senior Member
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 8:48 am

Thanks a lot. That's some good info and a good place to start  

jhowe
Newbie
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 1:43 pm

Katana forensics makes a product called Lantern that parses the files returned from Apple very well and produces a nice report.

Eric  

EBWahlberg
Member
 
 
  

Re: PList and .db Files

Post Posted: Tue Jan 07, 2014 5:29 pm

I would echo DCS1094's comments, those are very good SQLite browsers and you should be able to highlight and drag and drop a bunch of the databases into SQLite Expert to view multiple DB's quickly.

Our software, IEF, can also parse individual DB files from iOS/Android devices by using the "File Dump" option, and may save you some time. If you have IEF and need instructions or don't have IEF and would like a trial, please feel free to reach out to me directly at jad(at)magnetforensics(dot)com.

Good luck!
Jad  

MagnetForensics
Member
 
 
  

Re: PList and .db Files

Post Posted: Thu Jan 09, 2014 11:23 pm

To view the Property List Files on a Windows machine you may want to look at Plist Editor for Windows

www.icopybot.com/download.htm

There is a freeware and a pro version.

Regards,

Chris Currier  

nlpd120
Senior Member
 
 
  

Re: PList and .db Files

Post Posted: Fri Jan 10, 2014 11:42 am

Why not use Cellebrite UFED to analyze the phones. Just played around with my personnel iP5 and if you get the passcode problem sorted out Cellebrite UFED Analyzer is a very nice tool to have an overview/ detailed data in a sorted way. You also have access to the file system itself to do some further stuff.  

Bitstorm
Senior Member
 
 

Page 1 of 2
Go to page 1, 2  Next