Locating common artifacts
Application-related artifacts are essential for an iOS investigation, but device settings, logs, and user-generated content are also important. In this final section of the chapter, we'll look into some common locations within the iOS filesystem that the examiner can quickly review to gather more information:
- The starting point for any iOS examination will most likely be
/private/var/mobile/Library/, as this folder contains artifacts that relate to device information as well as data pertaining to the user's iCloud account. Table 4.2 illustrates some of the files that may be of interest. /private/var/mobile/Library/Preferences/contains device configuration files and user-defined settings, such as language, device name, time settings, and so on. Most of the artifacts will be plists, either in XML or binary format.- Artifacts relating to the SIM card such as the phone number, IMEI, and network carrier can be found by analyzing the plists...
