Blog >> Apple Data Usage

Investigating Apple Data Usage

29/03/2024 Friday

Apple data usage keeps a record of inbound and outbound data traffic used by applications and processes. This feature in Apple devices keeps a record of applications and processes data consumption from different data sources such as WIFI and WWAN. Moreover, it records times and dates related to connections, first usage, and last usage.

Digital Forensics Value of Apple Data Usage

Apple Data Usage artifacts can be a crucial part of investigations in Apple device-related forensics investigations. The artifact can provide valuable insights into data consumption patterns. Forensic experts can benefit from data usage histories, revealing important information relevant to applications and processes data usage.

Location of Apple Data Usage Artifacts

Apple Data Usage artifacts can be found at the following location:
/private/var/wireless/Library/Databases/DataUsage.sqlite
/private/var/ networkd/db/netusage.sqlite

Analyzing Apple Data Usage Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Apple Data Usage artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Apple Data Usage artifact:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Apple Data Usage artifact in ArtiFast.

Apple Data Usage

• Time: The last connection date and time.
• Bundle ID: The bundle ID.
• The First Usage Date/Time: The first usage date and time.
• WIFI Out: The WIFI out bytes count.
• WIFI In: The WIFI in bytes count.
• Process Name: The process name.
• WWAN Out: The mobile/WWAN out bytes count.
• WWAN In: The in mobile/WWAN in bytes count.
• The Last Usage Date/Time: The last usage date and time.

For more information or suggestions please contact: ekrma.elnour@forensafe.com