Investigating iOS Venmo
05/01/2024 Friday
Venmo is a smartphone application owned by PayPal, designed for digital money transactions. It features a unique social feed that enables users to view their friends' transactions, adding a social element to the payment platform. Venmo also facilitates the seamless splitting of bills for shared expenses, simplifying group payments.
Digital Forensics Value of iOS Venmo
Analyzing the artifacts left behind by the iOS Venmo application can reveal sensitive information such as transaction logs, user interactions, and metadata associated with transactions. This information proves crucial in investigations related to financial transactions, fraud, or other legal matters. Digital forensics in iOS Venmo contributes to uncovering evidence, establishing timelines, and providing insights into user activities within the application.
Location of iOS Venmo App Artifacts
iOS Venmo App artifact can be found at the following locations:
/private/var/mobile/Containers/Data/Application/<App_GUID>/Documents/PrivateFeed
/private/var/mobile/Containers/Data/Application/<App_GUID>/Documents/FriendFeed
/private/var/mobile/Containers/Data/Application/<App_GUID>/Documents/PublicFeed
Analyzing iOS Venmo Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Venmo artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Venmo artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Venmo App artifact in ArtiFast.
iOS Venmo Transactions
- Audience: The type of the transaction audience.
- Note: The note associated with this transaction if any.
- Type: The transaction type.
- Amount: The amount of money involved in this transaction.
- Action: Indicates whether this transaction is pay or charge.
- Status: The transaction status.
- Date Completed: The date when this transaction has been completed.
- Date Created: The date when this transaction has been created.
- Payer Name: The transaction payer name.
- Payer Username: The transaction payer username as registered in Venmo.
- Receiver Name: The transaction receiver name.
- Receiver Username: The transaction receiver username as registered in Venmo.
iOS Venmo Users
- Joined Date: The date when this user has been joined.
- User ID: The user Unique Identifier.
- First Name: The user’s first name.
- Last Name: The user’s last name.
- Is Friend: Indicates whether this user is a friend to the phone owner or not.
- Display Name: The user display name.
- Username: The username.
- Is Blocked: Indicates whether this user is blocked by the phone owner or not.
- Is Active: Indicates whether this user is active or not.
- Is Payable: Indicates whether this user is payable or not.
- Identity Type: The user Identity Type.
- Profile Picture URL: The user profile picture URL.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
