DEVICE INFO - LOCKED, UNLOCKED
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/installd/Library/MobileInstallation/LastBuildInfo.plist | Operating system version | Y | Y | N |
| /private/var/mobile/Library/CoreDuet/coreduetd.db | Lock/Device Passcode Info (0=unlocked, 1=locked) (Up to iOS 9) | N | N | N |
| /private/var/mobile/Library/Logs/mobileactivationd/ | MobileActivation Logs | Y | N | Y |
| /private/var/mobile/Library/Preferences/com.apple.AdLib.plist | May show older iOS versions used | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.aggregated.plist | Last BootTime | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mmcs.plist | IMSIs | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mobilegestalt.plist | Device name | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plist | Time settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.preferences.network.plist | Airplane mode (on/off) | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.Preferences.plist | Disk usage | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist | Language, Country info, Device IDs | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.timed.plist | Auto Time and Auto Time Zone settings | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.networkidentification.plist | Network IP, WiFi, Cellular Information | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.radios.plist | Airplane mode (on/off) | Y | Y | N |
| /private/var/preferences/SystemConfiguration/NetworkInterfaces.plist | Wi-Fi Mac Addresses | Y | N | Y |
| /private/var/preferences/SystemConfiguration/preferences.plist | Network and VPN information | Y | Y | N |
| /private/var/root/Library/Lockdown/escrow_records/ | Computer Trust/Pair certificates | Y | N | N |
| /private/var/root/Library/Lockdown/pair_records/ | Computer Trust/Pair certificates | Y | N | N |
| /private/var/root/Library/Preferences/com.apple.preferences.network.plist | Airplane mode (on/off) | Y | Y | N |
| /private/var/wireless/Library/Preferences/com.apple.commcenter.plist | Device Info (IMEI, Phone Number, Network Carrier, ICCIDs, IMSIs, etc.) | Y | Y | N |
PASSWORDS AND ACCOUNT INFORMATION
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/mobile/Library/Accounts/Accounts3.sqlite | Account information | Y | Y | N |
| /private/var/mobile/Library/DataAccess/ | Account information used to set up apps (Email, #, etc) | Y | Y | N |
| /private/var/mobile/Library/DataAccess/AccountInformation.plist | Email sync data | Y | Y | N |
| /private/var/mobile/Library/DataAccess/iCloud-[iCloud email account name]/.mboxCache.plist | iCloud Email account information | Y | Y | N |
| /private/var/mobile/Library/Health/healthdb.sqlite | Health data, personal data, iOS version info, etc. | N | Y | N |
| /private/var/mobile/Library/Health/healthdb_secure.sqlite | Health data, personal data, iOS version info, etc. | N | Y | N |
| /private/var/mobile/Library/MedicalID/MedicalIDData.Archive | Medical Information (bloodtype, organ donor, name, DOB, etc.) | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.accountsettings.plist | Email accounts pushed to device | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.cmfsyncagent.plist | Blocked Dialers | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.commcenter.shared.plist | Phone number | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.conference.plist | Facetime phone number in use, SMS phone number, user accounts | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.contacts.donation-agent.plist | Last Metrics Attempts (usage information) | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.contextstored.plist | Activity throttling | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.coreduetd.plist | Activity throttling | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.corerecents.recentsd.plist | iCloud login information | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.FeedbackAssistant.plist | Last successful email address used to login to cloud | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.homesharing.plist | iCloud account information | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plist | Find My iPhone settings | Y | Y | N |
| /private/var/mobile/Library/UserConfigurationProfiles/ | Profiles and restrictions | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plist | Account information | Y | Y | N |
| /private/var/root/Library/Lockdown/data_ark.plist | Last backup computer, iCloud Backup Settings, Device info | Y | N | N |
| /private/var/wireless/Library/preferences/com.apple.commcenter.callservices.plist | Last iCloud account | Y | N | N |
SETTINGS - SYSTEM CONTROLLED - KEYBOARDS, DICTIONARY, LOGS, BT ADDRESS, etc.
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/installd/Library/Logs/MobileInstallation/mobile_installation.log.* | Mobile Applications Installation Logs | Y | N | Y |
| /private/var/mobile/Containers/ | Application Folders | Y | Y | N |
| /private/var/mobile/Library/BulletinBoard/ClearedSections.plist | Logs of cleared notifications | Y | Y | N |
| /private/var/mobile/Library/Keyboard/<language>-dynamic.lm/dynamic-lexicon.dat | Auto correction / Predictive text | N | N | N |
| /private/var/mobile/Library/Preferences/ | Examine plists for more information | Y | Y | N |
| /private/var/preferences/SystemConfiguration/NetworkInterfaces.plist | Wi-Fi Mac Addresses | Y | N | Y |
SETTINGS - USER CONTROLLED - SYNC SETTINGS, SPRINGBOARD, etc.
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfilesCloudConfigurationDetails.plist | Cloud configurations | N | N | N |
| /private/var/mobile/Library/DoNotDisturb/DB/Settings.json | Do not disturb settings | Y | Y | N |
| /private/var/mobile/Library/Keyboard/UserDictionary.sqlite | User created auto-correct | N | N | N |
| /private/var/mobile/Library/Mail/ | Mail and settings | N | N | N |
| /private/var/mobile/Library/Preferences/com.apple.assistant* | Siri | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plist | Cloud sync settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.camera.plist | Camera settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.celestial.plist | Camera, CarPlay, Volumes and other settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.cloudphotod.plist | Cloud photo sync information | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.CoreDuet.plist | Cloud sync settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.imservice* | SMS, iMessage and FaceTime | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist | Time to keep messages | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.preferences.network.plist | Airplane Mode Settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.springboard.plist | User created restrictions/Remote wipe settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.weather.plist | Weather (including current city) | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/HomeBackground.cpbitmap | Wallpaper | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail.jpg | Wallpaper | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/IconState.plist | Homescreen icon layout | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/LockBackground.cpbitmap | Wallpaper | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail.jpg | Wallpaper | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/LockBackgroundThumbnaildark.jpg | Wallpaper | Y | Y | N |
| /private/var/mobile/Library/SpringBoard/PushStore/ | Notifications | N | N | N |
| /private/var/mobile/Library/UserConfigurationProfiles/UserSettings.plist | User created restrictions | Y | Y | N |
| /private/var/mobile/Library/UserNotifications/ | User Notifications | Y | Y | N |
| /private/var/root/Library/Lockdown/data_ark.plist | Last backup computer, iCloud Backup Settings, Device info | Y | N | N |
| /private/var/root/Library/Preferences/com.apple.preferences.network.plist | Airplane Mode Settings | Y | Y | N |
COMMUNICATIONS - SMS, CALLS, EMAIL
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/mobile/Library/CallHistory/call_history.db | Call log (Up to iOS 7) | N | Y | N |
| /private/var/mobile/Library/CallHistoryDB/CallHistory.storedata | Call log (From iOS 8) | N | Y | N |
| /private/var/mobile/Library/CallHistoryDB/CallHistoryTemp.storedata | Call History Temporary storage (Before First Unlock) | Y | N | N |
| /private/var/mobile/Library/Mail/ | Mail and settings | N | N | N |
| /private/var/mobile/Library/Preferences/com.apple.madrid.plist | SMS, iMessage and FaceTime | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mobilephone.* | List of contacts added to the phone application’s favorites list | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.MobileSMS.plist | SMS, iMessage and FaceTime | Y | Y | N |
| /private/var/mobile/Library/Recents/ | Recents communications | N | N | N |
| /private/var/mobile/Library/SMS/Attachments/* | MMS File | N | Y | N |
| /private/var/mobile/Library/SMS/Drafts/* | SMS/MMS Drafts | N | Y | N |
| /private/var/mobile/Library/SMS/sms.db | SMS/MMS messages | N | Y | N |
| /private/var/mobile/Library/SMS/sms-temp.db | SMS Temporary storage (Before First Unlock) | Y | N | N |
| /private/var/mobile/Library/Suggestions/query_predictions.db | Contains iMessage/SMS traces | N | N | N |
| /private/var/mobile/Library/Voicemail/voicemail.db | Voicemail | Y | N | N |
| /private/var/mobile/Media/Recordings/* | Voice Memos | N | Y | N |
BROWSER ACTIVITY
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.mobilesafari/ | Safari Cache files | N | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.mobilesafari/Cache.db | Safari Cache database | N | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.WebAppCache/ApplicationCache.db | Safari Website cache | N | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Cookies/Cookies.binarycookies | Safari Cookies | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Favicons/Favicons/ | Safari Website favicons | N | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Preferences/com.apple.mobilesafari.plist | Safari Configuration | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Safari/Downloads/Downloads.plist | Safari Download History | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Safari/Thumbnails/ | Safari Tabs Screenshots (PNG or KTX format) | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/WebKit/WebsiteData/LocalStorage/* | Safari WebKit Localstorage | Y | Y | N |
| /private/var/mobile/Library/Assistant/knowledgeC.db | Safari History information | N | N | N |
| /private/var/mobile/Library/Safari/Bookmarks.db | Safari Bookmarks | N | Y | N |
| /private/var/mobile/Library/Safari/BrowserState.db | Safari Suspended State Tab | N | N | N |
| /private/var/mobile/Library/Safari/CloudTabs.db | Safari Cloud Tabs | N | N | N |
| /private/var/mobile/Library/Safari/History.db | Safari History | N | N | N |
MULTIMEDIA
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| *.ktx | Application Snapshots | N | N | N |
| /private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedb | Contacts pictures | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plist | Photos | Y | Y | N |
| /private/var/mobile/Library/SMS/Attachments/ | MMS File | N | Y | N |
| /private/var/mobile/Media/DCIM/1*APPLE | User Created/Saved Photos | N | Y | N |
| /private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedb | iTunes Media Library | Y | Y | N |
| /private/var/mobile/Media/PhotoData/*.ithmb | Thumbnails databases | N | Y | N |
| /private/var/mobile/Media/PhotoData/AlbumsMetadata/ | Photo Albums Metadata | N | Y | N |
| /private/var/mobile/Media/PhotoData/CPL/ | Cloud Photo Library | N | Y | N |
| /private/var/mobile/Media/PhotoData/Photos.sqlite | Photos/Videos Database | N | Y | N |
| /private/var/mobile/Media/PhotoData/V2/ | Photos saved from Live Video and SMS photo capture | N | Y | N |
NETWORK CONNECTIONS
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/db/dhcpclient/leases/ | DHCP Lease | Y | N | N |
| /private/var/mobile/Library/Preferences/com.apple.preferences.network.plist | Airplane mode ON/OFF | Y | Y | N |
| /private/var/networkd/netusage.sqlite | Network data usage per App | N | N | N |
| /private/var/preferences/com.apple.networkextension.plist | Network Extension | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.networkidentification.plist | Network IP, Wi-Fi, Cellular | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.wifi.plist | Wi-Fi | Y | Y | Y |
| /private/var/preferences/SystemConfiguration/NetworkInterfaces.plist | Wi-Fi Mac Addresses | Y | N | Y |
| /private/var/preferences/SystemConfiguration/preferences.plist | Wi-Fi, VPN, Certs and more | Y | Y | N |
| /private/var/root/Library/Preferences/com.apple.preferences.network.plist | Wi-Fi ON/OFF | Y | Y | N |
| /private/var/wireless/Library/Databases/CellularUsage.db | SIMs used in device, including most recent | Y | Y | N |
| /private/var/wireless/Library/Preferences/com.apple.CommCenter.counts.plist | Data and Cellular network statistics | Y | Y | N |
| /private/var/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plist | Device IMEI | Y | Y | N |
| /private/var/wireless/Library/Preferences/com.apple.commcenter.plist | SIM Card ICCID | Y | Y | N |
SYNCING ARTIFACTS
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.other.db | Seen Bluetooth devices | N | Y | N |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.paired.db | Paired Bluetooth devices | Y | Y | N |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/Preferences/com.apple.MobileBluetooth.devices.plist | Paired Bluetooth devices | N | Y | N |
| /private/var/mobile/Library/DataAccess/iCloud-[iCloud email account name]/.OfflineCache/[number] | iClould offline cache | Y | Y | N |
| /private/var/mobile/Library/DeviceRegistry.state/activeStateMachine.plist | Apple Watch pairing information | Y | Y | N |
| /private/var/mobile/Library/DeviceRegistry.state/historySecureProperties.plist | Apple Watch information (also previously paired Apple Watch) | N | Y | N |
| /private/var/mobile/Library/DeviceRegistry.state/stateMachine-<GUID>.plist | Apple Watch pairing information (also previously paired Apple Watch) | N | Y | N |
| /private/var/mobile/Library/DeviceRegistry/<GUID>/ | Apple Watch data | Y | Y | N |
| /private/var/mobile/Library/DeviceRegistry/<GUID>/NanoAppRegistry/Applications/ | Apple Watch Applications | Y | Y | N |
| /private/var/mobile/Library/DeviceRegistry/<GUID>/NanoMail/registry.sqlite | Apple Watch Mail application | Y | Y | N |
| /private/var/mobile/Library/DeviceRegistry/<GUID>/NanoPasses/nanopasses.sqlite3 | Apple Watch Wallet Passes | N | Y | N |
| /private/var/mobile/Library/DeviceRegistry/<GUID>/NanoPreferencesSync/Backup/Files/ | Apple Watch Faces | Y | Y | N |
| /private/var/mobile/Library/Health/NanoSync/com.apple.private.alloy.health.sync.db | AppleWatch Health data sync | N | Y | N |
| /private/var/mobile/Library/homed/datastore.sqlite | Apple HomeKit Devices | N | Y | N |
| /private/var/mobile/Library/MobileBluetooth/com.apple.MobileBluetooth.ledevices.plist | Seen Bluetooth devices | Y | Y | N |
| /private/var/mobile/Library/NanoBackup/ | Apple Watch information | Y | Y | N |
| /private/var/mobile/Library/NanoMusicSync/ | Apple Watch information | Y | N | N |
| /private/var/mobile/Library/NanoPreferencesSync/ | Apple Watch information | Y | N | N |
| /private/var/mobile/Library/NanoTimeKit/ | Apple Watch information | Y | N | N |
| /private/var/mobile/Library/Preferences/com.apple.carplay.plist | Apple CarPlay configuration | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.cloud.quota.plist | iCloud quota information | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.CoreDuet.QueuedDenials.plist | Cloud Sync denials and dates | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.coreduetd.plist | sync devices | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist | iCloud sync, Email, FaceTime, Email, more | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mobile.ldbackup.plist | Last iTunes and last iCloud backup date and timezone. | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.nano*.plist | Apple Watch preferences | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.sharingd.plist | Device AirDrop ID | Y | Y | N |
| /private/var/mobile/Library/Springboard/<GUID>-CarDisplay[Desired]IconState.plist | Apple CarPlay per car App Icon configuration | Y | Y | N |
| /private/var/mobile/Media/iTunesControl/iTunes/iTunesPrefs | List of computer where the device was connected to | Y | Y | N |
| /private/var/root/Library/Lockdown/data_ark.plist | Last backup computer, iCloud Backup Settings, Device info | Y | N | N |
| /private/var/wireless/Library/Databases/DataUsage-watch.sqlite | Watch Application Usage | N | N | N |
LOCATION ARTIFACTS
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.other.db | Seen Bluetooth devices | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Maps/GeoHistory.mapsdata | Apple Maps history | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Maps/History.mapsdata | Apple Maps history | N | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Preferences/com.apple.Maps.plist | Last latitude and longitude, map search history | Y | Y | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.Maps.recents.plist | Apple Maps recents | Y | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.bookmarks.plist | Apple Maps bookmarks | Y | N | N |
| /private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.history.plist | Apple Maps history | Y | N | N |
| /private/var/mobile/Containers/Shared/AppGroup/<Apple_MAPS_GUID>/Library/Preferences/group.com.apple.Maps.plist | Last latitude and longitude, map search history | Y | Y | N |
| /private/var/mobile/Library/Caches/com.apple.routined/Cache.sqlite | Location information | N | N | N |
| /private/var/mobile/Library/Caches/com.apple.routined/Local.sqlite | Location information | N | N | N |
| /private/var/mobile/Library/Preferences/com.apple.locationd.plist | "Location Services" setting (Enabled = 1; Disabled = 0) | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plist | Time settings | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist | Language, Country info, Device IDs | Y | Y | N |
| /private/var/preferences/SystemConfiguration/com.apple.networkidentification.plist | Network IP, WiFi, Cellular | Y | Y | N |
| /private/var/preferences/SystemConfiguration/preferences.plist | Network and VPN information | Y | Y | N |
| /private/var/root/Library/Caches/locationd/Cache.sqlite | Location information | N | N | N |
| /private/var/root/Library/Caches/locationd/cache_encryptedA.db | Location information | N | N | N |
| /private/var/root/Library/Caches/locationd/cache_encryptedB.db | Location information | N | N | N |
| /private/var/root/Library/Caches/locationd/cache_encryptedC.db | Location information | N | N | N |
| /private/var/root/Library/Caches/locationd/consolidated.db | Application Traces and GeoFence information | Y | Y | N |
| /private/var/root/Library/Caches/locationd/significant.plist | Significant Location | N | Y | N |
| /private/var/root/Library/Caches/locationd/significantVisitAuth.plist | Significant Location | Y | Y | N |
| /private/var/root/Library/Caches/locationd/significantVisitInterest.plist | Significant Location | Y | Y | N |
APPLICATION USAGE
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/installd/Library/Logs/MobileInstallation/mobile_installation.log.* | Mobile Applications Installation Logs | Y | N | Y |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/BatteryLife/CurrentPowerLog.PLSQL | Battery life tracker | N | N | Y |
| /private/var/mobile/Library/AggregatedDictionary/ADDataStore.sqlitedb | Application traces | Y | N | N |
| /private/var/mobile/Library/AppConduit/AvailableApps.plist | Installed Apps and Apps Path | Y | N | N |
| /private/var/mobile/Library/AppConduit/AvailableCompanionApps.plist | Installed Apps and Apps Path | Y | N | N |
| /private/var/mobile/Library/Application Support/com.apple.remotemanagmentd/RMAdminStore-Local.sqlite | Screen time | N | N | N |
| /private/var/mobile/Library/ApplicationSync/AssetSortOrder.plist | Application order on the SpringBoard | Y | N | N |
| /private/var/mobile/Library/Assistant/knowledgeC.db | Application traces | N | N | N |
| /private/var/mobile/Library/com.apple.itunesstored/itunesstored2.sqlitedb | Application traces | Y | Y | N |
| /private/var/mobile/Library/com.apple.itunesstored/kvs.sqlitedb | Installed Applications | Y | Y | N |
| /private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.db | Application traces | N | N | N |
| /private/var/mobile/Library/CoreDuet/People/interactionC.db | Application traces | N | Y | N |
| /private/var/mobile/Library/FrontBoard/applicationState.db | Application traces | Y | Y | N |
| /private/var/mobile/Library/Health/ActivitySharing/contacts2.dat | Fitness Friends | N | N | N |
| /private/var/mobile/Library/Keyboard/langlikelihood.dat | Application traces | Y | Y | N |
| /private/var/mobile/Library/locationd/user.plist | Step/Stride Cadence, Pedometer Info | N | Y | N |
| /private/var/mobile/Library/Logs/AppConduit/ | Installed Apps and Apps Path | Y | N | Y |
| /private/var/mobile/Library/Logs/mobile_installation_helper.log* | Application traces | N | Y | N |
| /private/var/mobile/Library/Preferences/addaily.plist | Application traces | Y | Y | N |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/Logs/mobile_installation_helper.log.* | Application traces | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.ActivitySharing.plist | Information about Fitness Friends | Y | Y | N |
| /private/var/mobile/Library/preferences/com.apple.AppStore.plist | Last search on Apple Store | Y | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.corespotlightui.plist | Application traces | Y | Y | N |
| /private/var/mobile/Library/TCC/TCC.db | Applications permissions | Y | Y | N |
| /private/var/networkd/netusage.sqlite | Network data usage per App | N | N | N |
| /private/var/root/Library/Caches/locationd/clients.plist | Application traces | Y | Y | N |
| /private/var/root/Library/Logs/MobileContainerManager | MobileContainerManager logs | Y | N | Y |
| /private/var/root/Library/MobileContainerManager/containers.sqlite3 | Installed Applications | Y | N | N |
| /private/var/wireless/Library/Databases/DataUsage.sqlite | Application traces | Y | N | N |
TRACES OF DESTRUCTION - WIPING, etc.
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/mobile/Library/Preferences/com.apple.purplebuddy.plist | Language, Country info, Device IDs | Y | Y | Y |
| /private/var/root/.obliterated | Creation time stamp -> Device reset time | Y | N | N |
| /private/var/root/Library/Preferences/com.apple.MobileBackup.plist | Restore information (timestamp, local vs. iCloud) | Y | Y | Y |
BATTERY/POWER
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/containers/Shared/SystemGroup/<GUID>/Library/BatteryLife/CurrentPowerLog.PLSQL | Battery life tracker | N | N | Y |
| /private/var/mobile/Library/CoreDuet/coreduetd.db | Powering Events (0=unplugged, 1=plugged in) | N | N | N |
| /private/var/mobile/Library/Preferences/com.apple.BatteryCenter.BatteryWidget.plist | Battery icon status | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.coreduetd.batterysaver.state.plist | Battery Saver state | Y | N | N |
NATIVE APPLICATIONS - NOTES, etc.
Path | Description | BFU | BACKUP | SYSDIAGNOSE |
| /private/var/mobile/Containers/Shared/AppGroup/<Apple_Notes_GUID>/NoteStore.sqlite | iCloud Notes | N | Y | N |
| /private/var/mobile/Library/AddressBook/AddressBook.sqlitedb | Contacts | N | y | N |
| /private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedb | Contact Images | N | Y | N |
| /private/var/mobile/Library/Calendar/Calendar.sqlitedb | Calendar | N | Y | N |
| /private/var/mobile/Library/Calendar/Extras.db | Extras for Calendar | Y | Y | N |
| /private/var/mobile/Library/Calendar/Notifications.Calendar.Protected | Calendar entries | Y | N | N |
| /private/var/mobile/Library/Mail/ | Mail and settings | N | N | N |
| /private/var/mobile/Library/Notes/Library/Notes/notes.idx | Notes | N | N | N |
| /private/var/mobile/Library/Notes/notes.sqlite | Notes | N | Y | N |
| /private/var/mobile/Library/Passes/ | Apple Passes | N | Y | N |
| /private/var/mobile/Library/Preferences/com.apple.mobilenotes.plist | Notes | Y | Y | N |
ITUNES BACKUP MEDATA
File | Description | BFU | BACKUP | SYSDIAGNOSE |
| /Lockdown/device_values.plist | Activated state, BT address and more | N | Y | N |
| info.plist | Identifiers about iOS device (phone number, version, etc) | N | Y | N |
| manifest.plist | Encryption state, installed apps and more | N | Y | N |
| status.plist | Last backup date and other identifiers | N | Y | N |
Последнее редактирование:
