iPhone File Locatio...
 
Notifications
Clear all

iPhone File Locations

6564matt
(@6564matt)
New Member

Hi All, 

To give a slight bit of context, I am in the middle of looking at a CSE investigation:

I have an iPhone 11 Pro, extracted using Graykey (Full File System), Decoded in Cellebrite PA v7.42 and media processed within Griffeye v20.2...

I have come across some evidential files in the following locations:

 

  • \private\var\mobile\Containers\Shared\AppGroup\2DBB8A72-50F3-4D24-B8A9-77E3B5DDADAC\File Provider Storage\photospicker

 

  • \private\var\mobile\Containers\Data\PluginKitPlugin\46569158-9FD0-4B4E-B502-4FE682CC03FD\Library\Caches\com.apple.NanoTimeKit\com.apple.NanoTimeKitCompanion.CreateWatchFace\FaceResourceLinks

 

I have highlighted in red the application location that I haven't come across before. I have done a search for both App ID's which doesn't give much of a clue.

For the 2nd path listed, I understand it's something to do with the background 'face' of the Apple Watch, is it anything to do with the history of the users watch faces they have manually set as the background? 

Just wondering if any info can be given with any details of these locations - as this will need to be comfortably explained in a statement at some point...

 

Appreciate your time & any info given.

Quote
Topic starter Posted : 19/05/2021 8:25 am
Topic Tags
PensiveHike
(@pensivehike)
New Member

The App IDs are not unique and are generated differently for each device. If you look in the directory of:

\private\var\mobile\Containers\Shared\AppGroup\2DBB8A72-50F3-4D24-B8A9-77E3B5DDADAC

there should be a plist file that will tell you the application this folder belongs to. It will mention com.***.*, which you can then google to identify the application.

 

For the other part of the question, I have no idea, sorry.

ReplyQuote
Posted : 26/05/2021 7:26 pm
17ArCam liked
Share: