Investigating iOS Google Voice
16/05/2025 Friday
The Google Voice app is a communication tool available on most major
platforms. In addition to dedicated apps for iOS and Android, it can
also be accessed on many commonly used desktop operating systems.
Furthermore, it is usable on any device without installation, as it
supports all major web browsers. Google Voice is primarily a
U.S.-focused service, with limited functionality for international
users. Mainly for those who already have a U.S. number or use it through
a Google Workspace subscription. The app provides U.S. users with a free
phone number for calling, texting, and voicemail, all accessible over
Wi-Fi or mobile data.
Digital Forensics Values of iOS Google Voice
In digital investigations, Google Voice can be a crucial source of corroborative communication data, as the artifacts it leaves behind may contain valuable evidence. The extracted data can help investigators gather information about a user's suspicious communication activities, identity details, or even cross-device usage. br />
Location of iOS Google Voice
iOS Google Voice artifacts can be found at the following locations:
/private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Library/Application
Support/<USER_ID>/voiceClientSettings
/private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Library/Application
Support/<USER_ID>/threadingStore.sqlite
/private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/Library/Caches/<USER_ID>/peopleStore.sqlite
Analyzing iOS Google Voice Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Google
Voice artifacts from iOS machines’ files and what kind of digital
forensics insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select iOS
Google Voice artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Google Voice artifacts in ArtiFast.
iOS Google Voice Text Messages
- Message Sent Date/Time: Message Sending Date/Time.
- Message Direction: Indicates whether this is an outgoing or incoming message.
- Text Content: The text content of the message.
- Is Read: Indicates whether the message was read or not.
- Sender Number: The number of the sender of this message.
iOS Google Voice Attachments
- Message Sent Date/Time: Message Sending Date/Time.
- Message Direction: Indicates whether this is an outgoing or incoming message.
- Is Read: Indicates whether the message was read or not.
- Sender Number: The number of the sender of this message.
- Attachment File Name: This Attachment File Name.
- Attachment File Path: The location of the file in this iOS device.
iOS Google Voice Calls
- Caller Number: The number of the user who made the call.
- Call Direction: The direction of this call.
- Call Date/Time: The call Date/Time.
- Call Duration: The call duration in seconds.
iOS Google Voice Contacts
- Profile Picture URL: Profile picture URL.
- Full Name: This user full name.
- First Name: This user first name.
- Last Name: This user last name.
- Phone Number: This user phone number.
- User ID: The user Unique Identifier.
- Account ID: The account Unique Identifier.
- Number Label: The label associated with this user ID.
- Last Modified Date/Time: The last modified date/time of this contact information.
iOS Google Voice Account Information
- Phone Number: The phone number associated with this account.
- Linked Phones Name: The Linked Phones Name.
- Linked Phones Number: The Linked Phones Number.
- Linked VOIP Devices ID: The Linked VOIP Devices ID.
- Linked VOIP Devices Name: The Linked VOIP Devices Name.
- Linked VOIP Devices Number: The Linked VOIP Devices Number.
- Primary Device ID: The Primary Device unique identifier.
- Region Code: The region code where this account is used.
- Is Anonymous Caller ID Enabled: Indicates whether the Anonymous Caller ID is enabled on this device or not.
iOS Google Voice Voicemails
- Message Sent Date/Time: Message Sending Date/Time.
- Is Read: Indicates whether the message was read or not.
- Sender Number: The number of the sender of this message.
- Voicemail ID: Attachment File Name.
- Voicemail File Path: The location of the voicemail recording file in this iOS device.
- Text Representation: The text representation of this voicemail.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
