Investigating Apple Podcasts
16/10/2026 Friday
Apple Podcasts is Apple's application for discovering, following,
downloading, and playing podcast shows and episodes. A show can be
followed and added to the library, while individual episodes can be
streamed or downloaded for later playback. As this activity occurs,
local library records may preserve show information, episode metadata,
playback state, and timestamps associated with the user's interaction
with the application.
Digital Forensics Value of Apple Podcasts
Apple Podcasts artifacts can help establish which shows were added to
the library and how individual episodes were handled over time. Show
records may identify followed or added programs through their titles,
authors, descriptions, feed addresses, and added or updated timestamps.
Episode records may contribute import, download, last-played, and
play-state modification times together with play counts, duration, file
size, and source URLs. When the two parser groups are reviewed together,
a show can be associated with its episodes, and a chronology of library
and playback activity can be developed.
Location of Apple Podcasts Artifacts
Apple Podcasts library and playback records can be found in the
following database:
/private/var/mobile/Containers/Shared/AppGroup/<APP_GROUP_UUID>/Documents/MTLibrary.sqlite
Analyzing Apple Podcasts Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract Apple Podcasts
artifacts from iOS device files and what kind of digital forensics
insights can be gained from the artifacts.
After a case has been created and evidence has been added for the
investigation, at the Artifact Selection phase, the Apple Podcasts
artifact parsers can be selected.
×
Once the ArtiFast parser plugins complete processing the artifacts for analysis, they can be reviewed via Artifact View or Timeline View, with indexing, filtering, and searching capabilities. Below is a detailed description of Apple Podcasts artifacts in ArtiFast.
Apple Podcasts Episodes
- Import Date/Time: The date and time when the episode was imported into the local Podcasts library.
- Title: The title of the episode or show.
- Author: The creator or publisher associated with the episode or show.
- Play Count: The number of plays recorded for the episode.
- Subtitle: The subtitle retained for the episode.
- Download Date/Time: The date and time associated with downloading the episode.
- Duration: The episode duration in seconds.
- Size: The stored episode file size in bytes.
- Play State Last Modified: The date and time when the recorded playback state was last changed.
- Play State: The numeric playback-state value retained for the episode.
- Metadata Timestamp: The timestamp associated with the episode metadata.
- Last Played Date/Time: The most recent recorded playback time associated with the episode or show.
- Web Page URL: The webpage address associated with the episode or show.
- Asset URL: The URL of the episode's media asset.
Apple Podcasts Shows
- Added Date/Time: The date and time when the show was added to the Podcasts library.
- Title: The title of the episode or show.
- Author: The creator or publisher associated with the episode or show.
- Description: The description retained for the show.
- Last Played Date/Time: The most recent recorded playback time associated with the episode or show.
- Downloaded Date/Time: The date and time associated with downloading the show's content.
- Last Updated Date/Time: The date and time when the show metadata was last updated.
- Feed URL: The podcast feed address associated with the show.
- Web Page URL: The webpage address associated with the episode or show.
For more information or suggestions please contact: asli.beyhan@forensafe.com
