Investigating Apple Known Wi-Fi Networks
03/05/2024 Friday
Connecting to Wi-Fi networks on your Apple device such as iPhone, allows you to save that network's information for future use. This feature is very useful for frequently used networks in certain locations, like your home, workplace, or gym. By saving these networks, you avoid the hassle of repeatedly entering passwords, ensuring effortless and automatic connection. However, managing these saved networks, including deletion, is entirely in your hands, by default, this information is saved until the user decides to delete it by forgetting the network option.
Digital Forensics Value of Apple Known Wi-Fi Networks
Investigating wi-fi connections is a crucial part when it comes to mobile phone forensics. The Wi-Fi-related data can help to identify the geographical location where the device was used. Moreover, the artifact contains information related to data usage and dates and times when the user connected to the network. Such information would have great value in creating a timeline of events and tracking user activity.
Location of Apple Known Wi-Fi Networks Artifacts
Apple Known Wi-Fi Networks artifacts can be found at the following location on iOS devices:
\private\var\preferences\com.apple.wifi.known-networks.plist
Analyzing Apple Known Wi-Fi Networks Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Apple Known Wi-Fi Networks artifact from iOS devices' files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select Apple Known Wi-Fi Networks artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Apple Known Wi-Fi Networks artifact in ArtiFast.
Apple Known Wi-Fi Networks
- Last Update Time: The Last update date and time.
- SNR: The account username.
- Strength: The account type.
- SSID: The network SSID.
- Joined By User At: The data and time when the user joined the network.
- Joined By System At: The data and time when the system joined the network.
- Device Name: The parent account ID.
- Supported Security Type: The account credential type.
- 802.11d Country Code: Account PID.
- Channel: The Wi-Fi channel.
- BSSID: The network BSSID.
- Network Usage: The network usage.
- Security Mode: The network security mode.
- Model Name: The network device model.
- Serial Number: The network device’s serial number.
- Manufacturer: The network device manufacturer.
- WiFi Password Modification Date: The date and time when the password was modified.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
