The iOS IMO app, developed by PageBites Inc, is a free messaging application known for its user-friendly interface and strong focus on security. With features such as text messaging, voice and video calls, media sharing, and group chats, IMO offers comprehensive messaging experience. It employs end-to-end encryption for message privacy and allows users to set self-destruct timers for added security.
IMO as most of instant messaging application; holds significant value in digital forensics. With its widespread use and diverse features, analyzing the artifacts left behind by IMO can provide valuable insights for forensic investigations. As an integral mode of communication, IMO's messages, media files, and call records can offer crucial evidence in tracking and uncovering illicit activities.
iOS IMO artifacts records are in database in the SQLite format which can be found at the following location:
Private\var\mobile\Containers\Data\Application\<App_GUID>\Documents\IMODb2.sqlite
This section will discuss how to use ArtiFast to extract iOS IMO artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS IMO artifact:
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS IMO artifact in ArtiFast.
iOS IMO Contacts
iOS IMO Calls
iOS IMO Messages
iOS IMO User Channels
iOS IMO Stories
For more information or suggestions please contact: [email protected]