Investigating iOS IMO
28/06/2024 Friday
The iOS IMO app, developed by PageBites Inc, is a free messaging application known for its user-friendly interface and strong focus on security. With features such as text messaging, voice and video calls, media sharing, and group chats, IMO offers comprehensive messaging experience. It employs end-to-end encryption for message privacy and allows users to set self-destruct timers for added security.
Digital Forensics Value of iOS IMO
IMO as most of instant messaging application; holds significant value in digital forensics. With its widespread use and diverse features, analyzing the artifacts left behind by IMO can provide valuable insights for forensic investigations. As an integral mode of communication, IMO's messages, media files, and call records can offer crucial evidence in tracking and uncovering illicit activities.
Location and Structure of iOS IMO Artifacts
iOS IMO artifacts records are in database in the SQLite format which can be found at the following location:
Private\var\mobile\Containers\Data\Application\<App_GUID>\Documents\IMODb2.sqlite
Analyzing iOS IMO Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS IMO artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS IMO artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS IMO artifact in ArtiFast.
iOS IMO Contacts
- Contact Phone The contact's phone number li>BUID: The contact's alias identifier.
- Is Group Indicates whether the contact is a group
- Is Blocked: Indicates whether the contact is blocked or not.
- Is Muted: Indicates whether the contact is muted or not.
- Profile Picture URL: The contact's profile picture URL.
- Direction: Indicates whether the file was sent or received.
- Contact Title: The contact title.
- Contact Name: The contact name.
- Display Name: The contact's display name.
iOS IMO Calls
- Time: Date and time of the call.
- Caller/Callee Name: Username of the Caller or Callee.
- Chat Type: Indicates whether the call is incoming or outgoing.
- Duration: Call duration in milliseconds.
- Call State: Indicates whether the call was answered or missed.
- Call Type: Indicates whether the call was a video or audio call.
iOS IMO Messages
- Time: Date and time when the message was received.
- BUID: User’s alias identifier.
- Text: The message content.
- Message Type: Indicates whether the message was sent or received.
- Message State: Indicates whether the message contains text, emoji, or else.
- Message Read: Indicates whether the message was read or not.
- Sender/Receiver The partenr's name
- Sender Date/Time: Date and time when the message was sent.
- Partener Phone Number: The partener's phone number.
iOS IMO User Channels
- Time: Date and time of the last message in the channel.
- User Channel ID: Channel’s ID.
- Channel Name: Channel’s name.
- Description: Channel’s description.
- Channel Type: Channel’s type.
- Channel Status: Channel’s owner related information.
iOS IMO Stories
- Time: Date and time when the story was shared.
- Icon ID: The story icon ID.
- Object URL: Shared Object’s URL.
- BUID: User’s alias identifier.
- Is Mine: Indicates whether the story belongs to the user.
- Has Unread: Video duration in seconds.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
