Join Us!

iPhone X DataUsage....
 
Notifications
Clear all

iPhone X DataUsage.sqlite  

  RSS
ForensicChicken
(@forensicchicken)
New Member

I have an Advanced Logical Extraction, Method 1 of an iPhone X. I am attempting to determine what activity was happening at a given span of time. I have found two matches for the time frame given. I do not know how to interpret the what activity is going on by the 'ZPROCNAME' column. I found this in /var/wireless/Library/Databases/DataUsage.sqlite>ZPROCESS It shows accountsd/com.apple.datausage.itunesaccount and dataaccessd/com.apple.datausage.docsandsync. What does this mean?

And I also found two corresponding time frame hits in /var/wireless/Library/Databases/DataUsage.sqlite>ZLIVEUSAGE but here i am attempting to determine what ZWWANIN and ZWWANOUT. I feel like these are related and it is showing how much data was transfered. Would this be cellular data not wifi? Also, is it meaning in bytes or kilobytes, or megabyte?

It cut off

Thank You,

ForensicChicken

Quote
Posted : 21/10/2019 11:55 pm
deeFIR
(@deefir)
Junior Member

Also, is it meaning in bytes or kilobytes, or megabyte?

It's in bytes.

Here's a good resource for some more explanation; https://www.mac4n6.com/blog/2019/1/6/network-and-application-usage-using-netusagesqlite-amp-datausagesqlite-ios-databases

ReplyQuote
Posted : 22/10/2019 2:49 am
ForensicChicken
(@forensicchicken)
New Member

Thank you, This article is helpful.

ForensicChicken

ReplyQuote
Posted : 23/10/2019 1:53 pm
Share: