Investigating iOS TikTok
16/02/2024 Friday
TikTok is a social media platform and mobile application that enables users to create and share short videos set to music. The app was initially launched in 2016 under the name Musical.ly and was subsequently merged with the Chinese social media app Douyin in 2017. TikTok is renowned for its short-form, lip-sync, and comedy videos, as well as its user-generated content and creative challenges. The app can be downloaded for free from the App Store or Google Play Store and is available on both iOS and IOS devices. TikTok has gained popularity among younger users and has been downloaded over two billion times worldwide.
Digital Forensics Value of iOS TikTok
Various pieces of information may be of use in a digital forensics investigation involving TikTok. These may include the user's personal information, such as their name, email address, phone number, and location; video content created and shared on the platform; user contacts; and direct messages exchanged with other users.
Location of iOS TikTok App Artifacts
iOS TikTok App artifact can be found at the following location:
/private/var/mobile/Containers/Data/Application/<App_GUID>/
Analyzing iOS TikTok Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS TikTok artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS TikTok artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS TikTok App artifact in ArtiFast.
iOS TikTok Contacts
- Time: The last chat date and time.
- Nickname: User nickname.
- Profile Picture URL: The profile picture’s URL.
- Contact Name: Username.
- Contact ID: User unique identifier.
- Following Status: User Follow status.
iOS TikTok Messages
- Time: Date/Time message was sent.
- Server Date/Time: The date and time the message was received on the server.
- Sender ID: The message sender ID.
- Receiver ID: The message recipient ID.
- Content: Message content.
- Has Read: Indicates whether the message was read.
- Is Deleted: Indicates whether the message was deleted.
- Message Type: The type of the message.
- Message Metadata: The metadata with information related to the message.
iOS TikTok Users Videos
- Time: Date/Time video uploaded.
- Last Modified Date/Time: The last time the video was modified.
- File Name: The name of the File.
- File Local Path: Video location in local storage.
- File Extension: The extension of the video.
- Last Accessed Date/Time: The last time the video was accessed.
iOS TikTok Active Sessions
- OS Version: The operation system of the device where the session was started.
- App Version: The application version where the session was started.
- Session Duration: The duration of the session in seconds.
- Session ID: The session unique identifier.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
