Blog >> iOS Gmail

iOS Gmail

09/01/2026 Friday

Gmail is one of the largest email services available today. Google provides a mobile application for iOS that allows users to access their Gmail accounts on smartphones. The application includes support for multiple accounts, notifications, search functionality, and standard Gmail features such as conversation view, labels, spam filtering, and Smart Reply.

Digital Forensics Values of iOS Gmail

From a digital forensics’ perspective, iOS Gmail can hold evidentiary value because it may contain user communications and metadata relevant to an investigation. Analyzing its left-behind artifacts can reveal information about email content, attachments, sender and recipient details, timestamps, labels, and account identifiers. Collecting this information can help investigators reconstruct communication timelines, identify involved parties, and correlate email activity with other digital evidence.

Location of iOS Gmail Artifacts

iOS Gmail artifacts can be found at the following locations:
/private/var/mobile/Containers/Data/Application/<APP_GUID>/Library/Application Support/data/<USER_EMAIL>/sqlitedb
/private/var/mobile/Containers/Data/Application/<APP_GUID>/Library/Caches/Contacts_*.db
/private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Library/Preferences/group.com.google.Gmail.plist
*/com.google.android.gm/databases/bigTopDataDB*

Analyzing iOS Gmail Artifact with ArtiFast

This section will discuss how to use ArtiFast to extract iOS Gmail artifact from iOS machines’ files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Gmail artifact parsers:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Gmail artifacts in ArtiFast.

iOS Gmail Mails

• From: Sender email address.
• To: Recipient email address(es).
• Subject: Subject of the email.
• Date/Time: Email sent/received timestamp.
• Body: Full body text of the email.
• Snippet: A snippet of the email.
• Message ID: Unique identifier of this email message.
• Message Direction: Indicates whether this is an outgoing or incoming message.
• Sender Name: Name of the Sender.
• Sender Website Url: Url of the sender website.
• DB Row ID: The DB row ID of the message that contains this attachment.

iOS Gmail Attachments

• Message DB Row ID: The DB row ID of the message that contains this attachment.
• File Name: The name of the attached file.
• File URL: The URL of the attached file.

iOS Gmail Contacts

• UID: Unique ID of this Gmail account.
• Full Name: Full name of the user.
• Email Address: Email address of the user.
• Profile Picture URL: Profile picture URL of the account.

iOS Gmail Accounts

• UID: Unique ID of this Gmail account.
• Email Address: Email address of the user.
• Profile Picture URL: Profile picture URL of the account.

iOS Gmail Label Details

• Label: Label.
• Unread Count: Unread Count.
• Total Count: Total Count.
• Unseen Count: Unseen Count.

iOS Gmail Offline Search

• Message ID: Message ID.
• Thread ID: Thread ID.
• Sender: Sender.
• Receiver: Receiver.
• Subject: Subject.
• Body: Body.
• CC: CC.
• BCC: BCC.
• Search Date/Time: Search Date/Time.

For more information or suggestions please contact: kalthoum.karkazan@forensafe.com