Summary

In this chapter, we learned what pattern-of-life forensics is and how an investigator can benefit from analyzing such data to visualize user behavior and detect abnormal patterns.

First, we introduced some of the databases that contain relevant data, such as KnowledgeC.db and InteractionC.db. Then, we learned how a device handles date and time, and the differences between Unix and Mac timestamps. We also learned how to convert a specific date and time to a timestamp and vice versa.

Later in the chapter, we focused on the most popular database found on an iOS device by performing a full filesystem acquisition – KnowledgeC.db. We learned which are the most data-rich tables and how the data is organized in different columns. Then, we described some of the most interesting events logged by this database and introduced SQL queries that can be used to query the database for application usage and user interaction.

Finally, in the last section of this chapter, we introduced...