±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 35894
New Yesterday: 0 Visitors: 140

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iOS NSKeyedArchiverFiles - Blog

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

iOS NSKeyedArchiverFiles - Blog

Post Posted: Apr 10, 12 13:41

I've pulled a bunch of cool data (especially chat data) from "NSKeyedArchiver" PList files on iOS devices in the past, but their structure isn't always totally obvious so I've put together a blog which goes over what they are and how they're structured, you can find it here: digitalinvestigation.w...-use-them/

I also updated our free python module (ccl_bplist) to unpack these files - if you're a Pythoneer you can get it here: code.google.com/p/ccl-bplist/

Hope that's of some use to you all!  

Page 1 of 1