Investigating iOS SMS
01/03/2024 Friday
SMS is an abbreviation to Short Message Service and it is an essential feature that can be found in Apple's mobile operating system. This service helps the phones’ users to send and receive text messages between iPhones and other mobile devices. iOS SMS integrates seamlessly with the Messages app on iPhones, offering a straightforward interface for composing, sending, and managing text conversations. It utilizes cellular networks to transmit messages, ensuring widespread compatibility and reliability. Additionally, iOS SMS supports features such as group messaging, automatically deleting the verification codes after using them, and the ability to attach photos, videos files to messages.
Digital Forensics Value of iOS SMS
The significance of iOS SMS in digital forensics stems from its ability to deliver essential evidence and perspectives on communication undertakings carried out on Apple devices. SMS messages exchanged through iOS devices can serve as valuable artifacts in forensic investigations, offering details about conversations, contacts, timestamps, and potentially incriminating information. By analyzing the data collected from iOS SMS, digital forensic experts can reconstruct communication histories and timelines. This information can be pivotal in criminal investigations, legal proceedings, and corporate security incidents, providing investigators with vital leads, corroborating evidence, and uncovering pertinent details.
Location of iOS SMS Artifacts
iOS SMS artifacts can be found at the following locations:
/private/var/mobile/Library/SMS/sms.db
Analyzing iOS SMS Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS SMS artifact from iOS devices’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS SMS artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS SMS artifact in ArtiFast.
iOS SMS
- Message Time: The message received or sent date/time.
- Text: The message content.
- Subject: The message Subject.
- Partner ID: The message partner’s number or email.
- Message Direction: The direction of the message (incoming or outgoing).
- Message Read Time: The date/time when this message has been read by the user.
- Message Delivered Time: The date/time when this message has been delivered to this device.
- User Account: The user account used when sending this message.
- Is Read: Indicates whether this message has been read or not.
- Chat GUID: Text contains the service provider name with the chat identifier.
- Message GUID: The message’s unique ID.
- User Account GUID: The user account’s unique ID.
- Chat Identifier: The chat’s partner identifier.
- Is Auto Reply: Indicates whether this message is an auto reply message or not.
- Is Delivered: Indicates whether this message has been delivered or not.
- Is Empty: Indicates whether this message is an empty message or not.
- Is Archive: Indicates whether this message has been archived or not.
- Is Sent: Indicates whether this message has been sent or not yet.
- Is System Message: Indicates whether this message is a system message or not.
- Partner Country: The message partner’s country code.
- Partner Uncanonicalized ID: The partner uncanonicalized ID.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
