Steam app for iOS and Android

Do you have any test data you could share?

What sort of files do the artefacts appear to be in?

None that I can share. I have the chat.plist from the iPod, but since that has identifying data, I can't share it.

The file that has my attention currently is chats.plist. It has strings that are obviously part of a chat session, but it has a lot of extra stuff that I can't place what it means or does.

Any help on chats.plist or any other artifacts in the Steam app would be appreciated.

The file that has my attention currently is chats.plist. It has strings that are obviously part of a chat session, but it has a lot of extra stuff that I can't place what it means or does.

I've seen a number of plist file parsers available, which might be able to provide some information regarding the "extra stuff"…which sounds like binary contents. You may even be able to contact the authors and find out a bit more information…

Forgive my lack of clarity.

Viewing the plist is easy, it's the interpretation. But there are a lot of extra xml tags and values that, as of yet, mean nothing to me. I can see the chat messages, steam profile ID, and even the times (though I don't yet know what form they are in.

However, it has a lot of <integer> tags which contain 1-3 numbers, and <string> tags that start with NS.

I did contact Valve, but nothing as of yet.

Does the file mention NSKeyedArchiver? If so there's a good reason that it's not making a lot of sense when you view it.

If so this post might be of interest http//digitalinvestigation.wordpress.com/2012/04/04/geek-post-nskeyedarchiver-files-what-are-they-and-how-can-i-use-them/

I shall have to check when I get back to the office tomorrow, but

<key>CF$UID</key>
<integer>2</integer>

Is definitely in the chats.plist file.

Thank you, I shall definitely keep you posted.

OK, that's almost certainly NSKeyedArchiver. You'll need to "unpack" it before it makes any sense.

If you're happy using Python, we've open sourced a module which you can use to do the unpacking and then parse the data as a native python object, you can get it here https://code.google.com/p/ccl-bplist/ (I'm happy to offer some guidance on the use of the module).

Otherwise PIP can unpack NSKeyedArchiver and then you can use XPath to parse it (PIP can generate the XPath in a nice point-and-click way, so you don't really need to know XPath to use it ) ). http//ccl-forensics.com/pip

I tried using ccl_bplist.py, but I am not getting it.

When I use it as `ccl_bplist.py chats.plist`, it just echos back the copyright notice.

I haven't run many python scripts from the command line, so I feel kinda like a monkey trying to use a computer.

Any additional help would be appreciated.

Hi,

I've replied here http//www.forensicfocus.com/Forums/viewtopic/p=6566042/#6566042