Hi,
I'm wondering if there are any phone forensicators that have worked on a Kik database that can help identify the user of a Kik account on a device (iPhone in this case)
I have UFEDs Physical Analyser telling me the user name, e.g. KIKUSER1. and its accompanying Name and email address within the User Account in P.A.
When I extract the sqlite database and view it, I can see all this information in the ZKIKUSER table. However, there is nothing in that DB that specifically states that THIS is the phone owner (Telephone number doesn't appear to be associated)
I'm taking this from the word of Physical Analyser that this is correct. However, when I produced my report, the Kik chat messages were all associated with a random Kik profile from the contacts. So now I'm not convinced and I don't know which is correct.
The database doesn't appear to have any unique ID fields that state this is the owner?
Any help or pointers much appreciated.
(PS. Just loading it through IEF now, but not sure if it will give me any new information)
Thanks,
4F
I believe the 'com.kik.chat.plist' PList file holds the active user account data.
This is located in the following location /Library/Preferences/com.kik.chat.plist
It might be worth exporting the above file and analysing using a PList viewer.
DING DING DING!
We have a winner!
THANK YOU! )
That marries up exactly with the User Account extracted.
Still don't know why the PDF report had a different user, but thats OK, I have the data I need.
Thanks again.
4F