ios Hotspot Logs?
 
Notifications
Clear all

ios Hotspot Logs?

5 Posts
3 Users
0 Likes
1,097 Views
(@fred777)
Posts: 2
New Member
Topic starter
 

I have an Iphone 5 which had been setup as a hotspot (tethering). Now, does anyone know where one can find logs for hotspot information?

Ideally I am trying to determine what devices were connected to it, and what sort of data usage services were being run.

Any thoughts? )

 
Posted : 03/10/2014 9:16 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

what tools do you have at your disposal?

 
Posted : 03/10/2014 10:20 am
(@fred777)
Posts: 2
New Member
Topic starter
 

Hi Adam,

Cellebrite extraction device and the physical analyzer software (to do advanced logicals). No Physical extractions available unfortunantly

 
Posted : 03/10/2014 10:37 am
Adam10541
(@adam10541)
Posts: 550
Honorable Member
 

Just looking at my phone there are 3 ways for a device to connect to the 'hotspot' phone, WiFi, Bluetooth and via USB (assuming a computer wants to use the iPhone connection).

Have you checked the records PA reports under the Wifi and Bluetooth sections?

I'm just about to do a test with my iPad and iPhone to see if anything is recorded there as my thinking is there may not be a seperate place for hotspot logs because the phone may simply see them as just another wifi or bluetooth connection.

The bad news is that if it is stored there it doesn't seem to report anything more than the device name and mac address. There may be plist files or other logs files with more information but nothing that I've been able to dig up at this point.

Edit Connecting via bluetooth to the hotspot left my iPad name and Mac address in the bluetooth devices field that UFED can find, connecting via WiFi didn't leave any footprint in the wireless networks are that UFED extracts (which is not unexpected). I'm parsed the .tar download with Xways and was able to locate my iPad mac listed, however as Xways doesn't decode the UFED download correctly the text surrounding the mac address is junk.

It's nearly 5pm on a Friday so that's all the testing I've got time for right now as bourbon is calling me. Let me know if you find out anything further as this would be an interesting one.

 
Posted : 03/10/2014 1:21 pm
PaulSanderson
(@paulsanderson)
Posts: 651
Honorable Member
 

I have just completed adding a binary PList viewer to my new Forensic Browser for SQLite.

Testing has shown that IOS devices often use Binary Plists embedded as blobs within sqlite databases - this might be a place to look for a possible answer

 
Posted : 06/10/2014 5:44 pm
Share:
Share to...