Investigating iOS Uber
27/12/2024 Friday
The Uber app, widely recognized as a leading ride-hailing platform, offers a seamless way for users to book private car rides with just a few taps. As a Mobility-as-a-Service (MaaS) solution, it streamlines transportation access for its users. However, the application also retains substantial data on the device it operates on, making it a notable subject for digital forensic analysis, particularly in understanding its data storage and potential investigative value.
Digital Forensics Value of iOS Uber Artifacts
The digital forensic analysis of the iOS Uber application can provide critical insights into user activity and stored data. Uber stores information such as ride history, payment details, location tracking, and user interactions within the app. These data points are valuable for investigating user behavior, locations visited, or disputes related to the app’s use. Understanding Uber’s data storage architecture on iOS devices can aid in extracting and analyzing this information, contributing to legal or security-related cases.
Location and Structure of iOS Uber Artifacts
iOS Uber artifact can be found at the following locations:
/private/var/mobile/Containers/Data/Application/<App_GUID>>/Library/Application Support/PersistentStorage/BootstrapStore/RealtimeRider.StreamModelKey/client
/private/var/mobile/Containers/Data/Application/<App_GUID>>/Documents/ur_message.db
Analyzing iOS Uber Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Uber artifacts from iOS devices and what kind of digital forensics insight we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Uber artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of the iOS Uber artifacts in ArtiFast.
iOS Uber Artifacts
The artifact contains information related to iOS Uber. The details you can view include:
iOS Uber Accounts
- Date: The time and date when the account was last used (UTC).
- First Name: The user’s first name.
- Last Name: The user’s last name.
- Email: The user’s email address.
- Phone Number: The user’s phone number.
- Profile Picture URL: The account’s holder profile picture URL.
- Total Completed Riders Trip Count: The total completed rides trip count.
- City: The user’s city.
- Country Code: The country code associated with the account.
- Last Payment Profile ID: The last payment profile ID used.
iOS Uber Location Data
- Date: The time and date of the record.
- UI Date/Time: The timestamp of the user interface event associated with the record.
- Object Name: The name of the object associated with the record.
- City: The user’s city.
- Longitude: The location’s longitude.
- Latitude: The location’s latitude.
- Type: The type of message event associated with the location.
iOS Uber Nearby Vehicles
- Date/Time (UTC): The time and date of the record.
- Longitude: The location’s longitude.
- Latitude: The location’s latitude.
- Location: The identifier of the recorded location.
iOS Uber Payment Profiles
- Date: The time and date when last updated.
- Category: The category of the payment card.
- Status: The current status of the payment card.
- Card Number: The card number.
- UUID: The UUID of the card’s profile.
- Card BIN: The bank identification number of the card.
- Using Type: The intended use case of the card.
- Card Type: The type of the card used for payment.
- Account Name: The name associated with the payment account.
iOS Uber Places
- Date: The time and date of the record.
- Provider: Provider.
- Name: The name of the place.
- City: City.
- Longitude: The location’s longitude.
- Latitude: The location’s latitude.
- Type: The type of message event associated with the location.
- Distance Meters: Distance in meters.
- Address: The address.
- Full Address: The full address of the place.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
