• Курсы Академии Кодебай, стартующие в мае - июне, от команды The Codeby

    1. Цифровая криминалистика и реагирование на инциденты
    2. ОС Linux (DFIR) Старт: 16 мая
    3. Анализ фишинговых атак Старт: 16 мая Устройства для тестирования на проникновение Старт: 16 мая

    Скидки до 10%

    Полный список ближайших курсов ...

Заметка iOS Cheatsheet (Path, Description, BFU, BACKUP, SYSDIAGNOSE)

Темы, которые НЕ подходят по объему под префикс "Статья"

Sunnych

Mod. Forensics
Gold Team
01.06.2018
276
1 448
BIT
28
DEVICE INFO - LOCKED, UNLOCKED
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/installd/Library/MobileInstallation/LastBuildInfo.plistOperating system versionYYN
/private/var/mobile/Library/CoreDuet/coreduetd.dbLock/Device Passcode Info (0=unlocked, 1=locked) (Up to iOS 9)NNN
/private/var/mobile/Library/Logs/mobileactivationd/MobileActivation LogsYNY
/private/var/mobile/Library/Preferences/com.apple.AdLib.plistMay show older iOS versions usedYYN
/private/var/mobile/Library/Preferences/com.apple.aggregated.plistLast BootTimeYYN
/private/var/mobile/Library/Preferences/com.apple.mmcs.plistIMSIsYYN
/private/var/mobile/Library/Preferences/com.apple.mobilegestalt.plistDevice nameYYN
/private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plistTime settingsYYN
/private/var/mobile/Library/Preferences/com.apple.preferences.network.plistAirplane mode (on/off)YYN
/private/var/mobile/Library/Preferences/com.apple.Preferences.plistDisk usageYYN
/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plistLanguage, Country info, Device IDsYYN
/private/var/mobile/Library/Preferences/com.apple.timed.plistAuto Time and Auto Time Zone settingsYYN
/private/var/preferences/SystemConfiguration/com.apple.networkidentification.plistNetwork IP, WiFi, Cellular InformationYYN
/private/var/preferences/SystemConfiguration/com.apple.radios.plistAirplane mode (on/off)YYN
/private/var/preferences/SystemConfiguration/NetworkInterfaces.plistWi-Fi Mac AddressesYNY
/private/var/preferences/SystemConfiguration/preferences.plistNetwork and VPN informationYYN
/private/var/root/Library/Lockdown/escrow_records/Computer Trust/Pair certificatesYNN
/private/var/root/Library/Lockdown/pair_records/Computer Trust/Pair certificatesYNN
/private/var/root/Library/Preferences/com.apple.preferences.network.plistAirplane mode (on/off)YYN
/private/var/wireless/Library/Preferences/com.apple.commcenter.plistDevice Info (IMEI, Phone Number, Network Carrier, ICCIDs, IMSIs, etc.)YYN

PASSWORDS AND ACCOUNT INFORMATION
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/mobile/Library/Accounts/Accounts3.sqliteAccount informationYYN
/private/var/mobile/Library/DataAccess/Account information used to set up apps (Email, #, etc)YYN
/private/var/mobile/Library/DataAccess/AccountInformation.plistEmail sync dataYYN
/private/var/mobile/Library/DataAccess/iCloud-[iCloud email account name]/.mboxCache.plistiCloud Email account informationYYN
/private/var/mobile/Library/Health/healthdb.sqliteHealth data, personal data, iOS version info, etc.NYN
/private/var/mobile/Library/Health/healthdb_secure.sqliteHealth data, personal data, iOS version info, etc.NYN
/private/var/mobile/Library/MedicalID/MedicalIDData.ArchiveMedical Information (bloodtype, organ donor, name, DOB, etc.)NYN
/private/var/mobile/Library/Preferences/com.apple.accountsettings.plistEmail accounts pushed to deviceYYN
/private/var/mobile/Library/Preferences/com.apple.cmfsyncagent.plistBlocked DialersYYN
/private/var/mobile/Library/Preferences/com.apple.commcenter.shared.plistPhone numberYYN
/private/var/mobile/Library/Preferences/com.apple.conference.plistFacetime phone number in use, SMS phone number, user accountsYYN
/private/var/mobile/Library/Preferences/com.apple.contacts.donation-agent.plistLast Metrics Attempts (usage information)YYN
/private/var/mobile/Library/Preferences/com.apple.contextstored.plistActivity throttlingYYN
/private/var/mobile/Library/Preferences/com.apple.coreduetd.plistActivity throttlingYYN
/private/var/mobile/Library/Preferences/com.apple.corerecents.recentsd.plistiCloud login informationYYN
/private/var/mobile/Library/Preferences/com.apple.FeedbackAssistant.plistLast successful email address used to login to cloudYYN
/private/var/mobile/Library/Preferences/com.apple.homesharing.plistiCloud account informationYYN
/private/var/mobile/Library/Preferences/com.apple.icloud.findmydeviced.FMIPAccounts.plistFind My iPhone settingsYYN
/private/var/mobile/Library/UserConfigurationProfiles/Profiles and restrictionsYYN
/private/var/preferences/SystemConfiguration/com.apple.accounts.exists.plistAccount informationYYN
/private/var/root/Library/Lockdown/data_ark.plistLast backup computer, iCloud Backup Settings, Device infoYNN
/private/var/wireless/Library/preferences/com.apple.commcenter.callservices.plistLast iCloud accountYNN

SETTINGS - SYSTEM CONTROLLED - KEYBOARDS, DICTIONARY, LOGS, BT ADDRESS, etc.
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/installd/Library/Logs/MobileInstallation/mobile_installation.log.*Mobile Applications Installation LogsYNY
/private/var/mobile/Containers/Application FoldersYYN
/private/var/mobile/Library/BulletinBoard/ClearedSections.plistLogs of cleared notificationsYYN
/private/var/mobile/Library/Keyboard/<language>-dynamic.lm/dynamic-lexicon.datAuto correction / Predictive textNNN
/private/var/mobile/Library/Preferences/Examine plists for more informationYYN
/private/var/preferences/SystemConfiguration/NetworkInterfaces.plistWi-Fi Mac AddressesYNY

SETTINGS - USER CONTROLLED - SYNC SETTINGS, SPRINGBOARD, etc.
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/containers/Shared/SystemGroup/systemgroup.com.apple.configurationprofiles/Library/ConfigurationProfilesCloudConfigurationDetails.plistCloud configurationsNNN
/private/var/mobile/Library/DoNotDisturb/DB/Settings.jsonDo not disturb settingsYYN
/private/var/mobile/Library/Keyboard/UserDictionary.sqliteUser created auto-correctNNN
/private/var/mobile/Library/Mail/Mail and settingsNNN
/private/var/mobile/Library/Preferences/com.apple.assistant*SiriYYN
/private/var/mobile/Library/Preferences/com.apple.assistant.backedup.plistCloud sync settingsYYN
/private/var/mobile/Library/Preferences/com.apple.camera.plistCamera settingsYYN
/private/var/mobile/Library/Preferences/com.apple.celestial.plistCamera, CarPlay, Volumes and other settingsYYN
/private/var/mobile/Library/Preferences/com.apple.cloudphotod.plistCloud photo sync informationYYN
/private/var/mobile/Library/Preferences/com.apple.CoreDuet.plistCloud sync settingsYYN
/private/var/mobile/Library/Preferences/com.apple.imservice*SMS, iMessage and FaceTimeYYN
/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plistTime to keep messagesYYN
/private/var/mobile/Library/Preferences/com.apple.preferences.network.plistAirplane Mode SettingsYYN
/private/var/mobile/Library/Preferences/com.apple.springboard.plistUser created restrictions/Remote wipe settingsYYN
/private/var/mobile/Library/Preferences/com.apple.weather.plistWeather (including current city)YYN
/private/var/mobile/Library/SpringBoard/HomeBackground.cpbitmapWallpaperYYN
/private/var/mobile/Library/SpringBoard/HomeBackgroundThumbnail.jpgWallpaperYYN
/private/var/mobile/Library/SpringBoard/IconState.plistHomescreen icon layoutYYN
/private/var/mobile/Library/SpringBoard/LockBackground.cpbitmapWallpaperYYN
/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnail.jpgWallpaperYYN
/private/var/mobile/Library/SpringBoard/LockBackgroundThumbnaildark.jpgWallpaperYYN
/private/var/mobile/Library/SpringBoard/PushStore/NotificationsNNN
/private/var/mobile/Library/UserConfigurationProfiles/UserSettings.plistUser created restrictionsYYN
/private/var/mobile/Library/UserNotifications/User NotificationsYYN
/private/var/root/Library/Lockdown/data_ark.plistLast backup computer, iCloud Backup Settings, Device infoYNN
/private/var/root/Library/Preferences/com.apple.preferences.network.plistAirplane Mode SettingsYYN

COMMUNICATIONS - SMS, CALLS, EMAIL
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/mobile/Library/CallHistory/call_history.dbCall log (Up to iOS 7)NYN
/private/var/mobile/Library/CallHistoryDB/CallHistory.storedataCall log (From iOS 8)NYN
/private/var/mobile/Library/CallHistoryDB/CallHistoryTemp.storedataCall History Temporary storage (Before First Unlock)YNN
/private/var/mobile/Library/Mail/Mail and settingsNNN
/private/var/mobile/Library/Preferences/com.apple.madrid.plistSMS, iMessage and FaceTimeYYN
/private/var/mobile/Library/Preferences/com.apple.mobilephone.*List of contacts added to the phone application’s favorites listNYN
/private/var/mobile/Library/Preferences/com.apple.MobileSMS.plistSMS, iMessage and FaceTimeYYN
/private/var/mobile/Library/Recents/Recents communicationsNNN
/private/var/mobile/Library/SMS/Attachments/*MMS FileNYN
/private/var/mobile/Library/SMS/Drafts/*SMS/MMS DraftsNYN
/private/var/mobile/Library/SMS/sms.dbSMS/MMS messagesNYN
/private/var/mobile/Library/SMS/sms-temp.dbSMS Temporary storage (Before First Unlock)YNN
/private/var/mobile/Library/Suggestions/query_predictions.dbContains iMessage/SMS tracesNNN
/private/var/mobile/Library/Voicemail/voicemail.dbVoicemailYNN
/private/var/mobile/Media/Recordings/*Voice MemosNYN

BROWSER ACTIVITY
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.mobilesafari/Safari Cache filesNNN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.mobilesafari/Cache.dbSafari Cache databaseNNN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Caches/com.apple.WebAppCache/ApplicationCache.dbSafari Website cacheNNN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Cookies/Cookies.binarycookiesSafari CookiesNYN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Favicons/Favicons/Safari Website faviconsNNN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Preferences/com.apple.mobilesafari.plistSafari ConfigurationNYN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Safari/Downloads/Downloads.plistSafari Download HistoryNYN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/Safari/Thumbnails/Safari Tabs Screenshots (PNG or KTX format)NYN
/private/var/mobile/Containers/Data/Application/<Apple Safari GUID/Library/WebKit/WebsiteData/LocalStorage/*Safari WebKit LocalstorageYYN
/private/var/mobile/Library/Assistant/knowledgeC.dbSafari History informationNNN
/private/var/mobile/Library/Safari/Bookmarks.dbSafari BookmarksNYN
/private/var/mobile/Library/Safari/BrowserState.dbSafari Suspended State TabNNN
/private/var/mobile/Library/Safari/CloudTabs.dbSafari Cloud TabsNNN
/private/var/mobile/Library/Safari/History.dbSafari HistoryNNN

MULTIMEDIA
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
*.ktxApplication SnapshotsNNN
/private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedbContacts picturesNYN
/private/var/mobile/Library/Preferences/com.apple.mobileslideshow.plistPhotosYYN
/private/var/mobile/Library/SMS/Attachments/MMS FileNYN
/private/var/mobile/Media/DCIM/1*APPLEUser Created/Saved PhotosNYN
/private/var/mobile/Media/iTunes_Control/iTunes/MediaLibrary.sqlitedbiTunes Media LibraryYYN
/private/var/mobile/Media/PhotoData/*.ithmbThumbnails databasesNYN
/private/var/mobile/Media/PhotoData/AlbumsMetadata/Photo Albums MetadataNYN
/private/var/mobile/Media/PhotoData/CPL/Cloud Photo LibraryNYN
/private/var/mobile/Media/PhotoData/Photos.sqlitePhotos/Videos DatabaseNYN
/private/var/mobile/Media/PhotoData/V2/Photos saved from Live Video and SMS photo captureNYN

NETWORK CONNECTIONS
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/db/dhcpclient/leases/DHCP LeaseYNN
/private/var/mobile/Library/Preferences/com.apple.preferences.network.plistAirplane mode ON/OFFYYN
/private/var/networkd/netusage.sqliteNetwork data usage per AppNNN
/private/var/preferences/com.apple.networkextension.plistNetwork ExtensionYYN
/private/var/preferences/SystemConfiguration/com.apple.networkidentification.plistNetwork IP, Wi-Fi, CellularYYN
/private/var/preferences/SystemConfiguration/com.apple.wifi.plistWi-FiYYY
/private/var/preferences/SystemConfiguration/NetworkInterfaces.plistWi-Fi Mac AddressesYNY
/private/var/preferences/SystemConfiguration/preferences.plistWi-Fi, VPN, Certs and moreYYN
/private/var/root/Library/Preferences/com.apple.preferences.network.plistWi-Fi ON/OFFYYN
/private/var/wireless/Library/Databases/CellularUsage.dbSIMs used in device, including most recentYYN
/private/var/wireless/Library/Preferences/com.apple.CommCenter.counts.plistData and Cellular network statisticsYYN
/private/var/wireless/Library/Preferences/com.apple.commcenter.device_specific_nobackup.plistDevice IMEIYYN
/private/var/wireless/Library/Preferences/com.apple.commcenter.plistSIM Card ICCIDYYN

SYNCING ARTIFACTS
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.other.dbSeen Bluetooth devicesNYN
/private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.paired.dbPaired Bluetooth devicesYYN
/private/var/containers/Shared/SystemGroup/<GUID>/Library/Preferences/com.apple.MobileBluetooth.devices.plistPaired Bluetooth devicesNYN
/private/var/mobile/Library/DataAccess/iCloud-[iCloud email account name]/.OfflineCache/[number]iClould offline cacheYYN
/private/var/mobile/Library/DeviceRegistry.state/activeStateMachine.plistApple Watch pairing informationYYN
/private/var/mobile/Library/DeviceRegistry.state/historySecureProperties.plistApple Watch information (also previously paired Apple Watch)NYN
/private/var/mobile/Library/DeviceRegistry.state/stateMachine-<GUID>.plistApple Watch pairing information (also previously paired Apple Watch)NYN
/private/var/mobile/Library/DeviceRegistry/<GUID>/Apple Watch dataYYN
/private/var/mobile/Library/DeviceRegistry/<GUID>/NanoAppRegistry/Applications/Apple Watch ApplicationsYYN
/private/var/mobile/Library/DeviceRegistry/<GUID>/NanoMail/registry.sqliteApple Watch Mail applicationYYN
/private/var/mobile/Library/DeviceRegistry/<GUID>/NanoPasses/nanopasses.sqlite3Apple Watch Wallet PassesNYN
/private/var/mobile/Library/DeviceRegistry/<GUID>/NanoPreferencesSync/Backup/Files/Apple Watch FacesYYN
/private/var/mobile/Library/Health/NanoSync/com.apple.private.alloy.health.sync.dbAppleWatch Health data syncNYN
/private/var/mobile/Library/homed/datastore.sqliteApple HomeKit DevicesNYN
/private/var/mobile/Library/MobileBluetooth/com.apple.MobileBluetooth.ledevices.plistSeen Bluetooth devicesYYN
/private/var/mobile/Library/NanoBackup/Apple Watch informationYYN
/private/var/mobile/Library/NanoMusicSync/Apple Watch informationYNN
/private/var/mobile/Library/NanoPreferencesSync/Apple Watch informationYNN
/private/var/mobile/Library/NanoTimeKit/Apple Watch informationYNN
/private/var/mobile/Library/Preferences/com.apple.carplay.plistApple CarPlay configurationYYN
/private/var/mobile/Library/Preferences/com.apple.cloud.quota.plistiCloud quota informationYYN
/private/var/mobile/Library/Preferences/com.apple.CoreDuet.QueuedDenials.plistCloud Sync denials and datesYYN
/private/var/mobile/Library/Preferences/com.apple.coreduetd.plistsync devicesYYN
/private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plistiCloud sync, Email, FaceTime, Email, moreYYN
/private/var/mobile/Library/Preferences/com.apple.mobile.ldbackup.plistLast iTunes and last iCloud backup date and timezone.YYN
/private/var/mobile/Library/Preferences/com.apple.nano*.plistApple Watch preferencesYYN
/private/var/mobile/Library/Preferences/com.apple.sharingd.plistDevice AirDrop IDYYN
/private/var/mobile/Library/Springboard/<GUID>-CarDisplay[Desired]IconState.plistApple CarPlay per car App Icon configurationYYN
/private/var/mobile/Media/iTunesControl/iTunes/iTunesPrefsList of computer where the device was connected toYYN
/private/var/root/Library/Lockdown/data_ark.plistLast backup computer, iCloud Backup Settings, Device infoYNN
/private/var/wireless/Library/Databases/DataUsage-watch.sqliteWatch Application UsageNNN

LOCATION ARTIFACTS
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.other.dbSeen Bluetooth devicesNYN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Maps/GeoHistory.mapsdataApple Maps historyNYN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Maps/History.mapsdataApple Maps historyNYN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/Preferences/com.apple.Maps.plistLast latitude and longitude, map search historyYYN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.Maps.recents.plistApple Maps recentsYNN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.bookmarks.plistApple Maps bookmarksYNN
/private/var/mobile/Containers/Data/Application/<Apple_Maps_GUID>/Library/SyncedPreferences/com.apple.Maps-com.apple.MapsSupport.history.plistApple Maps historyYNN
/private/var/mobile/Containers/Shared/AppGroup/<Apple_MAPS_GUID>/Library/Preferences/group.com.apple.Maps.plistLast latitude and longitude, map search historyYYN
/private/var/mobile/Library/Caches/com.apple.routined/Cache.sqliteLocation informationNNN
/private/var/mobile/Library/Caches/com.apple.routined/Local.sqliteLocation informationNNN
/private/var/mobile/Library/Preferences/com.apple.locationd.plist"Location Services" setting (Enabled = 1; Disabled = 0)YYN
/private/var/mobile/Library/Preferences/com.apple.preferences.datetime.plistTime settingsYYN
/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plistLanguage, Country info, Device IDsYYN
/private/var/preferences/SystemConfiguration/com.apple.networkidentification.plistNetwork IP, WiFi, CellularYYN
/private/var/preferences/SystemConfiguration/preferences.plistNetwork and VPN informationYYN
/private/var/root/Library/Caches/locationd/Cache.sqliteLocation informationNNN
/private/var/root/Library/Caches/locationd/cache_encryptedA.dbLocation informationNNN
/private/var/root/Library/Caches/locationd/cache_encryptedB.dbLocation informationNNN
/private/var/root/Library/Caches/locationd/cache_encryptedC.dbLocation informationNNN
/private/var/root/Library/Caches/locationd/consolidated.dbApplication Traces and GeoFence informationYYN
/private/var/root/Library/Caches/locationd/significant.plistSignificant LocationNYN
/private/var/root/Library/Caches/locationd/significantVisitAuth.plistSignificant LocationYYN
/private/var/root/Library/Caches/locationd/significantVisitInterest.plistSignificant LocationYYN

APPLICATION USAGE
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/installd/Library/Logs/MobileInstallation/mobile_installation.log.*Mobile Applications Installation LogsYNY
/private/var/containers/Shared/SystemGroup/<GUID>/Library/BatteryLife/CurrentPowerLog.PLSQLBattery life trackerNNY
/private/var/mobile/Library/AggregatedDictionary/ADDataStore.sqlitedbApplication tracesYNN
/private/var/mobile/Library/AppConduit/AvailableApps.plistInstalled Apps and Apps PathYNN
/private/var/mobile/Library/AppConduit/AvailableCompanionApps.plistInstalled Apps and Apps PathYNN
/private/var/mobile/Library/Application Support/com.apple.remotemanagmentd/RMAdminStore-Local.sqliteScreen timeNNN
/private/var/mobile/Library/ApplicationSync/AssetSortOrder.plistApplication order on the SpringBoardYNN
/private/var/mobile/Library/Assistant/knowledgeC.dbApplication tracesNNN
/private/var/mobile/Library/com.apple.itunesstored/itunesstored2.sqlitedbApplication tracesYYN
/private/var/mobile/Library/com.apple.itunesstored/kvs.sqlitedbInstalled ApplicationsYYN
/private/var/mobile/Library/CoreDuet/Knowledge/knowledgeC.dbApplication tracesNNN
/private/var/mobile/Library/CoreDuet/People/interactionC.dbApplication tracesNYN
/private/var/mobile/Library/FrontBoard/applicationState.dbApplication tracesYYN
/private/var/mobile/Library/Health/ActivitySharing/contacts2.datFitness FriendsNNN
/private/var/mobile/Library/Keyboard/langlikelihood.datApplication tracesYYN
/private/var/mobile/Library/locationd/user.plistStep/Stride Cadence, Pedometer InfoNYN
/private/var/mobile/Library/Logs/AppConduit/Installed Apps and Apps PathYNY
/private/var/mobile/Library/Logs/mobile_installation_helper.log*Application tracesNYN
/private/var/mobile/Library/Preferences/addaily.plistApplication tracesYYN
/private/var/containers/Shared/SystemGroup/<GUID>/Library/Logs/mobile_installation_helper.log.*Application tracesNYN
/private/var/mobile/Library/Preferences/com.apple.ActivitySharing.plistInformation about Fitness FriendsYYN
/private/var/mobile/Library/preferences/com.apple.AppStore.plistLast search on Apple StoreYYN
/private/var/mobile/Library/Preferences/com.apple.corespotlightui.plistApplication tracesYYN
/private/var/mobile/Library/TCC/TCC.dbApplications permissionsYYN
/private/var/networkd/netusage.sqliteNetwork data usage per AppNNN
/private/var/root/Library/Caches/locationd/clients.plistApplication tracesYYN
/private/var/root/Library/Logs/MobileContainerManagerMobileContainerManager logsYNY
/private/var/root/Library/MobileContainerManager/containers.sqlite3Installed ApplicationsYNN
/private/var/wireless/Library/Databases/DataUsage.sqliteApplication tracesYNN

TRACES OF DESTRUCTION - WIPING, etc.
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/mobile/Library/Preferences/com.apple.purplebuddy.plistLanguage, Country info, Device IDsYYY
/private/var/root/.obliteratedCreation time stamp -> Device reset timeYNN
/private/var/root/Library/Preferences/com.apple.MobileBackup.plistRestore information (timestamp, local vs. iCloud)YYY

BATTERY/POWER
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/containers/Shared/SystemGroup/<GUID>/Library/BatteryLife/CurrentPowerLog.PLSQLBattery life trackerNNY
/private/var/mobile/Library/CoreDuet/coreduetd.dbPowering Events (0=unplugged, 1=plugged in)NNN
/private/var/mobile/Library/Preferences/com.apple.BatteryCenter.BatteryWidget.plistBattery icon statusNYN
/private/var/mobile/Library/Preferences/com.apple.coreduetd.batterysaver.state.plistBattery Saver stateYNN

NATIVE APPLICATIONS - NOTES, etc.
Path​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/private/var/mobile/Containers/Shared/AppGroup/<Apple_Notes_GUID>/NoteStore.sqliteiCloud NotesNYN
/private/var/mobile/Library/AddressBook/AddressBook.sqlitedbContactsNyN
/private/var/mobile/Library/AddressBook/AddressBookImages.sqlitedbContact ImagesNYN
/private/var/mobile/Library/Calendar/Calendar.sqlitedbCalendarNYN
/private/var/mobile/Library/Calendar/Extras.dbExtras for CalendarYYN
/private/var/mobile/Library/Calendar/Notifications.Calendar.ProtectedCalendar entriesYNN
/private/var/mobile/Library/Mail/Mail and settingsNNN
/private/var/mobile/Library/Notes/Library/Notes/notes.idxNotesNNN
/private/var/mobile/Library/Notes/notes.sqliteNotesNYN
/private/var/mobile/Library/Passes/Apple PassesNYN
/private/var/mobile/Library/Preferences/com.apple.mobilenotes.plistNotesYYN

ITUNES BACKUP MEDATA
File​
Description​
BFU​
BACKUP​
SYSDIAGNOSE​
/Lockdown/device_values.plistActivated state, BT address and moreNYN
info.plistIdentifiers about iOS device (phone number, version, etc)NYN
manifest.plistEncryption state, installed apps and moreNYN
status.plistLast backup date and other identifiersNYN


SANS iOS Third-Party.jpg
 

Вложения

  • SANS iOS Third-Party.zip
    822,9 КБ · Просмотры: 319
Последнее редактирование:
Мы в соцсетях:

Обучение наступательной кибербезопасности в игровой форме. Начать игру!