Investigating iOS Viber
12/07/2024 Friday
Viber is a Japanese application that provides cross-platform voice-over IP (VoIP) and instant messaging (IM) web services. IOS Viber allows users to send any kind of message such as text, video, contact info, and audio, and to exchange and share data with other users. In addition to that, Viber is available on Windows, Android, macOS, and iOS devices.
Digital Forensics Value of iOS Viber
iOS Viber artifacts provide information about phone/video calls, messages, and the application configuration data. Viber artifacts also contain information related to Chat messages, sent attachments, and more media-related data. Just similar to chatting applications Viber holds significant value in digital forensics investigation.
Location and Structure of iOS Viber Artifacts
iOS Viber artifacts can be found at the following location:
Private/var/mobile/Containers/Shared/AppGroup/<App_GUID>/com.viber/database/Contacts.data
Analyzing iOS Viber Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Viber artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Viber artifact:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Viber artifact in ArtiFast.
iOS Viber Individual Messages
- Message Date/Time: The date and time the message was received.
- Message State Time: The date and time when the message was delivered/read.
- Opened: Indicates whether the message was opened.
- Conversation ID: Conversation ID.
- Location Latitude: Location Latitude.
- State: Indicates the message state (delivered/read).
- Location Longitude: Location Longitude.
- Sender Name: Message sender name.
- Attachment Size: The attachment size in bytes.
- Participant ID: Participant ID.
- Body: Message body.
- Is Deleted: Indicates whether the message was deleted.
- Type: Message type.
- Message Direction: Indicates who the message was sent/or received.
iOS Viber Conversations
- Time: Last update date and time.
- Mute Notification: Indicate whether the conversation is muted or not.
- Message Draft: Message draft.
- Creator Participant ID: Conversation creator ID.
- Favorite Conversation: Indicate whether the conversation is favorited or not.
- Participant ID 1: Conversation first participant’s ID.
- Participant ID 2: Conversation second participant’s ID.
- Participant ID 3: Conversation third participant’s ID.
- Participant ID 4: Conversation fourth participant’s ID.
- Deleted: Indicate whether the conversation was deleted or not.
- Group ID: Group ID.
- Name: Conversation name.
- Conversation Type: Conversation type.
iOS Viber Contacts
- Time: The joined date if this contact has a Viber account.
- Contact Name: The contact’s name.
- Contact ID: The contact’s ID.
- Phone Number: The contact’s phone number.
- Has Viber: Indicates whether the contact has Viber or not.
iOS Viber Calls
- Time: Date and time of the call.
- Caller/Callee Name: Username of the Caller or Callee.
- Duration: Call duration in milliseconds.
- Call Direction: Indicates whether the call is incoming or outgoing.
- Viber Call Type: Indicate whether the call was Audio or Video.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
