Investigating iOS Instagram
14/06/2024 Friday
Instagram is a popular social media platform available on both Apple and Android devices. It is designed for users to share photos, videos, and stories with friends and followers. Known for its visual appeal, Instagram allows users to enhance their posts with filters, effects, and editing tools to create eye-catching content. With features like direct messaging, Reels for short-form videos, and live content sharing, Instagram has become a hub for personal expression, real-time updates, and global connection, making it a valuable platform in digital forensics for capturing user interactions and activities.
Digital Forensics Value of iOS Instagram Artifacts
Instagram has always been a successful and popular application. Within only two months of its launch, it reached 2 million users worldwide. The popularity of the Instagram application, coupled with the abundant forensics artifacts it leaves behind, is why forensics experts find it so interesting. Instagram holds significant value in digital forensics, serving as a rich source of data for understanding user behavior, social connections, and multimedia sharing patterns. With millions of users interacting daily, Instagram's digital footprint includes messages, shared photos, and videos all of which can reveal essential clues in investigations.
Location and Structure of iOS Instagram Artifacts
iOS Instagram artifacts are found in SQLite database at the following location:
Private/var/mobile/Containers/Shared/AppGroup/<App_GUID>/Library/Application Support/DirectSQLiteDatabase/****.db
Analyzing iOS Instagram Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Instagram artifacts from iOS devices and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Instagram artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the iOS Instagram artifacts in ArtiFast.
iOS Instagram Artifacts
The artifact contains information related to iOS Instagram. The details you can view include:
iOS Instagram Text Messages
- Send Date: The time and date the message was sent.
- Sender User Name: The message sender's username.
- Thread ID: The conversation’s thread ID.
- Sender Full Name: The message sender's full name.
- Type: The message type.
- Message Body: The message text content.
- Server ID: The message server ID.
iOS Instagram Media
- Send Date: The time and date the message was sent.
- Sender User Name: The message sender's username.
- Thread ID: The conversation’s thread ID.
- Sender Full Name: The message sender's full name.
- Type: The message type.
- Message Body: The message text content.
- Server ID: The message server ID.
- Media URL: The media file’s URL.
- Media ID: The media file’s ID.
iOS Instagram Call Events
- Send Date: The time and date the call was sent.
- Sender User Name: The caller’s username.
- Thread ID: The conversation’s thread ID.
- Sender Full Name: The caller’s full name.
- Type: The message type.
- Is Voice: Indicates the call’s media type, audio or video.
- Is Joined: Indicates whether the local user joined the call or didn’t.
- Call Description: The call’s message description.
- Message Body: The message text content.
- Server ID: The message server ID.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
