Apple iPhone 4 - Recovery of deleted internet history?
I have an iPhone 4, iOS 6.1.3, which has had its internet history cleared/deleted.
I have extracted the data from the phone with Oxygen Forensics (v18.104.22.168) and little or no internet history has been recovered.
My first question is, would a physical acquisition / extraction provide me with any further information than I already have? From the information I have been provided, a physical image (via Cellebrite's PA for example) would only give me email, Geo info, App data and executable - but not internet history. Unfortunately I do not have access to such a software/device to test this.
Secondly, I wish to parse the contents of cookies.binarycookies file into a clear and readable format, preferably into a spreadsheet with everything nicely laid out. I note some posts on here for various python scripts which i have tried without success. Could any kindly suggest a solution?
Any assistance would be most appreciated.
You could try importing the file dump from Oxygen into an alternative software tool such as IEF Advanced, which has the ability to parse the files; alternatively if you are able to complete a physical image of the device, I think IEF can also carve Safari web history from unallocated space. I believe Jad is offering a free trial. (I am nothing to do with Magnet Forensics, but have used it myself on iOS devices and results were good!). Safari stores all of it's history artifacts within the PList/database files; also applies to Chrome artifacts but some file names different.
com.apple.mobilesafari.plist (recent searches)
Hope this helps.
Secondly, I wish to parse the contents of cookies.binarycookies file into a clear and readable format, preferably into a spreadsheet with everything nicely laid out.
Safari Binary Cookie Parser
This Python script parses the Cookies.binarycookies file from the Safari Browser. It also parses the Google Analytic utma, utmb and utmz values. These values can include hits, timestamps and search terms. Output is in a tsv format. You can also choose to output in TLN format.
Update 11/01/2013 - released v.1.2 Minor Bug fixes for some GA values that were causing errors.
Update 12/30/2013 - released v.2.0 Added ability to parse partial binary cookie files, including carved binary cookie files.
Thank you DCS and jaclaz for your tips.