Blog >> iOS Skype

Investigating iOS Skype

26/07/2024 Friday

Skype is a widely used software, enables seamless communication among individuals and businesses. With features including free video and voice calls, instant messaging, and file sharing, Skype enhances interaction. It's accessible on laptops, mobiles, tablets, and supports Microsoft Windows, macOS, Linux, Android, iOS, and Windows Phone.

Digital Forensics Value of iOS Skype Artifacts

iOS Skype emerged as a digital goldmine for forensic experts, containing many artifacts that show user interactions. These artifacts encompass activity logs, files, and account details, offering crucial insights into user behavior. Within iOS Skype, artifacts encapsulate user accounts, activities, and shared files, calls, messages, and media —making it a goldmine for forensic insights. The treasure trove of data can serve as vital evidence.

Location of iOS Skype Artifacts

iOS Skype App artifacts can be found at the following locations:
Private/var/ mobile/Containers/Shared/AppGroup/<App_GUID>/s4l-live_.cid.****.db

Analyzing iOS Skype Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract iOS Skype artifacts from iOS device files and what kind of digital forensics insights we can gain from the artifacts.

After you have created your case and added evidence for investigation, at the Artifacts Parser Selection Phase, you can select Skype artifacts:

Once ArtiFast parser plugins complete processing artifacts for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Skype artifacts in ArtiFast software.

iOS Skype Calls Artifact

• Start Time - The date and time a call started.
• Participants - The participants of the call.
• Direction - Indicates the call direction (outgoing or ingoing).
• Type - Indicates the call type.
• State - Indicates the call status (missed, cancelled, busy, queued, starting, ringing, ongoing, or failed).
• Originator - The call source.
• Target - The call destination.
• End Time - The date and time a call ended.
• Connect Time - The date and time of when the call connected.
• ID - Id.
• Thread ID - The thread Id of a call.
• Message CUID - The message CUID of a call.

iOS Skype Scheduled Calls Artifact

• Scheduled Call Time - The date and time a call is scheduled.
• Subject - Subject of the scheduled call.
• Organizer - The user’s Id.
• Receivers - The participant(s) Id.
• ID - Id.
• CUID - CUID.
• Conversation ID - Conversation ID.

iOS Skype Conversations Artifact

• Creation Time - The date and time the last message was created.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Last Received Time - The date and time the last message was received.
• Conversation Status - Conservation status.
• Conversation ID - Conversation ID.
• Last Message Content - The last massage body.
• Last Message Type - The type of the last message.
• Last Message Creator - The author’s Id.
• Last Message From - The author’s chat.
• Is Blocked - Indicates whether the contact is blocked.
• Is Empty Conversation - Indicates whether the conversation is empty.
• Last Message ID - Id of the last message.
• Last Message Arrival Time - The Original Arrival date and time of the message.
• Last Message Compose Time - The date and time a message was composed.
• CUID - CUID.

iOS Skype Text Messages Artifact

• Creation Time - The date and time of the message.
• Content - The message body.
• Creator - The user’s Id.
• From - The author’s chat.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Conversation ID - Conversation ID
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• CUID - CUID.
• ID - Id.

iOS Skype Audio Messages Artifact

• Message Date - The date and time of the message.
• Link - Audio link.
• Original Name - The video original name.
• Title - Title.
• Description - The audio message description.
• File Size - The media size in Bytes.
• Thumbnail URL - The media thumbnail URL.
• Creator - The user’s Id.
• From - The author’s chat.
• Uri - The media Uri.
• Type - The media type.
• Conversation Link - The conversations that the current user has most recently interacted with.
• ID - Id.
• CUID - CUID.
• Conversation ID - Conversation ID.
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• Ams ID - Ams Id.

iOS Skype Video Messages Artifact

• Creation Time - The date and time of the message.
• Link - The video URL.
• Original Name - The video original name.
• Thumbnail URL - The video thumbnail URL.
• Uri - Video Uri.
• Title - Title.
• File Size - The video size in bytes.
• Description - Video description.
• Creator - The user’s Id.
• From - The author’s chat.
• CUID - CUID.
• Type - The file type.
• ID - Id.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Conversation ID - Conversation ID
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• Ams ID - Ams Id.

iOS Skype Photo Messages Artifact

• Creation Time - The date and time the message was created.
• Link - The photo URL.
• Original Name - The photo's original name.
• Title - Title.
• Description - The photo's description.
• Thumbnail URL - The photo thumbnail URL.
• File Size - The photo's size in bytes.
• Photo Width - The width of the photo.
• Photo Height - The hight of the photo.
• Creator - The user’s Id.
• From - The author’s chat.
• ID - Id.
• CUID - CUID.
• Type - The media type.
• Meta Type - Meta type.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Conversation ID - Conversation ID
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• Uri - The photo message Uri.
• Ams ID - Ams Id.

iOS Skype Contact Messages Artifact

• Creation Time - The date and time the message was created.
• Contact Info - The contact information.
• Creator - The author’s Id.
• From - The author’s chat.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• ID - Id.
• CUID - CUID.
• Conversation ID - Conversation ID.

iOS Skype File Message Artifact

• Creation Time - The date and time the message was created.
• Link - The file URL.
• Original Name - The photo's original name.
• Thumbnail URL - The photo thumbnail URL.
• Uri - The file Uri.
• Title - Title.
• File Size - The file size in bytes.
• Description - The file description.
• Creator - The author of the file Id.
• From - The author’s chat.
• CUID - CUID.
• File Type - The file type.
• ID - Id.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Conversation ID - Conversation ID
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• Ams ID - Ams Id.

iOS Skype Location Messages Artifact

• Creation Time - The date and time the message was created.
• Address - The address of messages.
• Address Friendly Name - The address of messages.
• Short Address - The address of messages.
• Latitude - The latitude of the message.
• Longitude - The longitude of the message.
• Timestamp - The location timestamp of the message.
• Time Zone - The time zone.
• Creator - The user’s Id.
• From - The author’s chat.
• User Mri - The user Mri.
• Locale - The message location.
• Conversation Link - The conversations that the current user has most recently interacted with.
• CUID - CUID.
• ID - Id.
• Conversation ID - Conversation ID
• Original Arrival Time - The Original Arrival date and time of the File message.
• Compose Time - The date and time the file message was composed.
• Ams ID - Ams Id.

iOS Skype Other Messages Artifact

• Creation Time - The date and time the message was created.
• Content - The message body.
• Message Type - Indicates the message type.
• Creator - The user’s Id.
• From - The author’s chat.
• Conversation Link - The conversations that the current user has most recently interacted with.
• Original Arrival Time - The Original Arrival date and time of the message.
• Compose Time - The date and time a message was composed.
• CUID - CUID.
• Conversation ID - Conversation ID
• ID - Id.

For more information or suggestions please contact: ekrma.elnour@forensafe.com