Investigating Clubhouse
12/05/2021 Wednesday
Clubhouse is the new hot social media platform that is gaining a ton of traction. The app was launched in April 2020, however, the app found popularity due to the recent appearances of celebrities and public figures such as Elon Musk. Clubhouse is an audio-only social media app; there are no texts, pictures or videos. Users gather in virtual audio chat “rooms” to discuss different topics of interest, turning any room into a public conference call.
Users can start a room or join a room hosted by a different user where they can interact and talk or simply listen to other people in the room. Clubhouse’s users can also join specific communities or “clubs” which are based on specific topics. It is considered highly business centric; however, Clubhouse’s users have conducted conversations, interviews and discussions on various topics such as personal development, tech, sports, politics and other diverse topics.
At the time of writing this blog, Clubhouse is only available on iOS. Any iOS user has the ability to download the app, but what makes Clubhouse different from other social media platforms, is that it is an invite-only social media platform. This means that to be able to access the app and its features, one has to receive an invitation from another Clubhouse member or by signing up for the waitlist.
Digital Forensics Value of Clubhouse Artifacts
Similar to other social media apps, the diverse and anonymous nature of Clubhouse makes it a possible medium for harassment and cybercrimes. This communication hub is also expanding and gaining more popularity over time. That is why it is important to be able to analyze and view critical artifacts that will support digital forensic investigations. Clubhouse artifact retain information related to the user’s account like the username, ID, and email of the user.
Structure and Location of Clubhouse Artifacts
The structure of the file containing Clubhouse artifacts is a binary property list (bplist), which is found at the following location:
Backup:
- File Name Hash → 54eb5747ca0a4fcce591526398ec9b5d8fd87e24
- File Domain → AppDomain-co.alphaexploration.clubhouse
- File Path under the Domain → Library/Preferences/co.alphaexploration.clubhouse.plist
Analyzing Clubhouse Artifacts using ArtiFast-Lite-Clubhouse
This section discusses how to use ArtiFast-Lite-Clubhouse to analyze Clubhouse artifacts from iOS devices and what kind of digital forensic insights we can gain from the platform.
As the name indicates, ArtiFast-Lite-Clubhouse is solely dedicated to analyzing Clubhouse’s artifact. After you have created your case and added evidence for the investigation, at the Artifacts Parser Selection Phase, you can select Clubhouse Artifact:
Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of Clubhouse artifact in ArtiFast-Lite-Clubhouse.
iOS Clubhouse Account Information Artifact
Clubhouse account information contains information related to the user account. The details you can view include:
- User Name - Username of the user.
- User ID - Unique identifier for the user.
- Device ID - Unique identifier for the device.
- Profile Picture URL - URL of the profile picture.
- Notifications Enabled - Indicates whether notifications are enabled by the user or not.
- E-Mail Address - Email address associated with the account.
- Name - Full name of the user.
- User On Waiting List - Indicates whether the user is on the waiting list to access the app or already has been invited.
- Total Listened Seconds - Total number of seconds the user have listened to.
- Device Token - Device token.
- Cached Following User IDs - Unique identifier for all accounts followed by the user.
