±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 4 Overall: 36205
New Yesterday: 1 Visitors: 214

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iPhone X DataUsage.sqlite

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

ForensicChicken
Newbie
 

iPhone X DataUsage.sqlite

Post Posted: Oct 21, 19 22:55

I have an Advanced Logical Extraction, Method 1 of an iPhone X. I am attempting to determine what activity was happening at a given span of time. I have found two matches for the time frame given. I do not know how to interpret the what activity is going on by the 'ZPROCNAME' column. I found this in /var/wireless/Library/Databases/DataUsage.sqlite>ZPROCESS It shows: accountsd/com.apple.datausage.itunesaccount and dataaccessd/com.apple.datausage.docsandsync. What does this mean?



And I also found two corresponding time frame hits in /var/wireless/Library/Databases/DataUsage.sqlite>ZLIVEUSAGE but here i am attempting to determine what ZWWANIN and ZWWANOUT. I feel like these are related and it is showing how much data was transfered. Would this be cellular data not wifi? Also, is it meaning in bytes or kilobytes, or megabyte?



It cut off:


Thank You,

ForensicChicken  
 
  

deeFIR
Member
 

Re: iPhone X DataUsage.sqlite

Post Posted: Oct 22, 19 01:49

- ForensicChicken

Also, is it meaning in bytes or kilobytes, or megabyte?


It's in bytes.

Here's a good resource for some more explanation; www.mac4n6.com/blog/20...-databases  
 
  

ForensicChicken
Newbie
 

Re: iPhone X DataUsage.sqlite

Post Posted: Oct 23, 19 12:53

Thank you, This article is helpful.

ForensicChicken  
 

Page 1 of 1