Blog >> iOS Voice Triggers

Investigating iOS Voice Triggers

26/01/2024 Friday

Voice triggers refer to specific phrases or keywords that activate voice-controlled virtual assistants on the devices. These triggers are designed to prompt the system to listen for user commands or inquiries. Apple Siri is one of the popular virtual assistants that use voice triggers for Apple devices, the voice triggers for Siri are “Hey Siri” and “Siri”. Users activate Siri by saying this phrase, followed by their command or question.

Digital Forensics Value of iOS Voice Triggers

Digital forensics for iOS voice triggers involves the examination of data and artifacts related to voice-activated interactions on Apple devices. This examination process can retrieve a history of voice commands issued through the iOS voice trigger, providing insights into user actions and intentions. The timestamps associated with these commands can also be retrieved, helping establish timelines of user activity.

Location of iOS Voice Triggers Artifacts

iOS Voice Triggers artifact can be found at the following location
/private/var/mobile/Library/VoiceTrigger/*/td/audio/

Analyzing iOS Voice Triggers Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract iOS Voice Triggers artifact from iOS device's files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Voice Triggers artifact:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Voice Triggers artifact in ArtiFast.

iOS Voice Triggers

• File Name: The name and extension of the file.
• File Path: The local path of the file.
• Size: The size of the file in bytes.
• Created Date/Time: The created date/time of the file in the file system.
• Last Accessed Date/Time: The last accessed date/time of the file in the file system.
• Last Modified Date/Time: The last modified date/time of the file in the file system.
• Device Type: The type of the iOS device.
• OS Version: The OS version when this voice trigger has been created.

For more information or suggestions please contact: [email protected]