Summary
In this chapter, we learned about third-party iOS applications. First, we learned where an application stores its data, how to identify installed applications, and how to associate an app with its GUID. Then, we focused on analyzing third-party apps. We introduced the concept of dynamic analysis and learned about the step-by-step process of analyzing an application. We also learned how to identify data containers using the cda tool, how to monitor filesystem changes, and how to visualize an application's network traffic.
Finally, we provided a practical cheat sheet with paths and descriptions of the most common artifacts that can be found in popular third-party iOS applications.
In the next chapter, we will discuss more advanced topics in iOS forensics.
