Blog >> iOS Voice Memos

Investigating iOS Voice Memos

07/06/2024 Friday

An iPhone device can be used as a portable recording device with the help of the Voice Memos app. It can be used to record personal voice notes, lectures, meetings, and interviews. This app features voice editing tools such as replace, trim, and resume. Additionally, it supports iCloud synchronization, ensuring recordings are accessible across all Apple devices linked to the same account if the user chooses to upload the recorded memos to iCloud. Users can also easily share their recordings via email, messages, or other apps.

Digital Forensics Value of iOS Voice Memos

Information extracted from iOS Voice Memos artifacts can play a crucial role in digital forensics. The audio content provides direct insights into conversations and verbal agreements, which are essential in legal cases. Metadata associated with these memos can be extracted and used to verify the presence of a device user at a particular location and time. Additionally, besides the recorded speech, background sounds in the recordings can serve as an extra source of valuable information, offering further context and details for forensic analysis.

Location of iOS Voice Memos Artifacts

iOS Voice Memos artifacts can be found at the following location:
* /Library/Application Support/com.apple.voicememos/Recordings/CloudRecordings.db
* /Library/Application Support/com.apple.voicememos/Recordings/Recordings.db

Analyzing iOS Voice Memos Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract iOS Voice Memos artifact from iOS devices' files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Voice Memos artifact parsers:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Voice Memos artifact in ArtiFast.

iOS Voice Memos

• Custom Label: The name of this voice memo as appeared on this device.
• Duration: The duration of this voice memo in seconds.
• iTunes Persistent ID: The iTunes persistent ID.
• Path: The file path of this voice memo file.
• Recording ID: The unique ID of this voice memo file.
• Recording Time: The date/time when this memo has been recorded.

For more information or suggestions please contact: kalthoum.karkazan@forensafe.com