Apple iPhone 4 - Re...
 
Notifications
Clear all

Apple iPhone 4 - Recovery of deleted internet history?  

  RSS
Jonny_Boy
(@jonny_boy)
New Member

Hi All,

I have an iPhone 4, iOS 6.1.3, which has had its internet history cleared/deleted.

I have extracted the data from the phone with Oxygen Forensics (v6.1.0.200) and little or no internet history has been recovered.

My first question is, would a physical acquisition / extraction provide me with any further information than I already have? From the information I have been provided, a physical image (via Cellebrite's PA for example) would only give me email, Geo info, App data and executable - but not internet history. Unfortunately I do not have access to such a software/device to test this.

Secondly, I wish to parse the contents of cookies.binarycookies file into a clear and readable format, preferably into a spreadsheet with everything nicely laid out. I note some posts on here for various python scripts which i have tried without success. Could any kindly suggest a solution?

Any assistance would be most appreciated.

Kind regards.

Quote
Posted : 07/03/2014 9:56 am
DCS1094
(@dcs1094)
Active Member

You could try importing the file dump from Oxygen into an alternative software tool such as IEF Advanced, which has the ability to parse the files; alternatively if you are able to complete a physical image of the device, I think IEF can also carve Safari web history from unallocated space. I believe Jad is offering a free trial. (I am nothing to do with Magnet Forensics, but have used it myself on iOS devices and results were good!). Safari stores all of it's history artifacts within the PList/database files; also applies to Chrome artifacts but some file names different.

Notable
History.plist
bookmarks.db
Cookies.binarycookies
com.apple.mobilesafari.plist (recent searches)

Hope this helps.

ReplyQuote
Posted : 07/03/2014 11:59 pm
jaclaz
(@jaclaz)
Community Legend

Secondly, I wish to parse the contents of cookies.binarycookies file into a clear and readable format, preferably into a spreadsheet with everything nicely laid out.

http//az4n6.blogspot.it/2013/08/safari-binary-cookies-now-with-more.html
http//az4n6.blogspot.com/p/downloads.html

Safari Binary Cookie Parser
This Python script parses the Cookies.binarycookies file from the Safari Browser. It also parses the Google Analytic utma, utmb and utmz values. These values can include hits, timestamps and search terms. Output is in a tsv format. You can also choose to output in TLN format.

Update 11/01/2013 - released v.1.2 Minor Bug fixes for some GA values that were causing errors.

Update 12/30/2013 - released v.2.0 Added ability to parse partial binary cookie files, including carved binary cookie files.

jaclaz

ReplyQuote
Posted : 08/03/2014 12:10 am
Jonny_Boy
(@jonny_boy)
New Member

Thank you DCS and jaclaz for your tips.

ReplyQuote
Posted : 09/03/2014 9:18 am
Share: