Notifications
Clear all

IOS app data

Kev21903
(@kev21903)
New Member

Is it possible to determine when applications are downloaded and deleted in iOS?

Quote
Topic starter Posted : 02/07/2019 10:56 am
dandaman_24
(@dandaman_24)
Active Member

Yes it is.

ReplyQuote
Posted : 02/07/2019 12:08 pm
passcodeunlock
(@passcodeunlock)
Senior Member

Jailbrake the device and check /var/log/* )

Many apps don't clean up well after removal, the dates of the remnant data could be also a lead.

ReplyQuote
Posted : 02/07/2019 7:13 pm
matrix4n6
(@matrix4n6)
New Member

I was not testing it yet but maybe it's worth a look The tool by Sarah Edwards https://github.com/mac4n6/apollo

ReplyQuote
Posted : 03/07/2019 5:34 am
dandaman_24
(@dandaman_24)
Active Member

In order to use Apollo, you need a FS which you can only get from a jailbroken device or from a GK / ufed premium dump

ReplyQuote
Posted : 03/07/2019 7:50 am
deeFIR
(@deefir)
Junior Member

In order to use Apollo, you need a FS which you can only get from a jailbroken device or from a GK / ufed premium dump

Not quite. APOLLO requires artefacts included in an encrypted iOS backup - ie Health database etc. It definitely doesn't have to be jailbroken to extract the required databases.

ReplyQuote
Posted : 15/07/2019 6:45 am
Kev21903
(@kev21903)
New Member

Once the device is jail broken what the best way to look at the root?

ReplyQuote
Topic starter Posted : 23/07/2019 12:08 pm
marky.mark
(@marky-mark)
New Member

Hi,

If you want you can connect yourself to the phone with a gui client like putty or just bare SSH to connect to the terminal.

If you want to take the forensic path, you make an aquisition of the device and work with that.

M.

ReplyQuote
Posted : 23/07/2019 3:03 pm
Kev21903
(@kev21903)
New Member

So the phone is jailbroken iOS 12.2

What is the next step to get a physical image?

ReplyQuote
Topic starter Posted : 24/07/2019 7:56 am
deeFIR
(@deefir)
Junior Member

You at least have to try and do some of the work yourself. You've literally been provided with all of the answers.

ReplyQuote
Posted : 24/07/2019 9:26 am
marky.mark
(@marky-mark)
New Member

Hi,

Here is a link that can help you http//lmgtfy.com/?q=how+to+create+forensic+image+of+iphone

Have a nice day.

M.

ReplyQuote
Posted : 24/07/2019 2:08 pm
Share:
Share to...