Investigating iOS KeepSafe
08/08/2025 Friday
KeepSafe is a mobile application designed to provide secure storage for
photos, videos, and other personal files. It uses passcodes, biometrics,
and encryption to restrict access and protect sensitive media from
unauthorized viewing. The app is popular among users seeking privacy for
their digital content, offering a hidden vault separate from the
standard iOS photo library. The iOS version enables users to import,
organize, and manage their private files directly from their devices
while maintaining a protected environment.
Digital Forensics Values of iOS KeepSafe
Forensic investigators can obtain critical evidence from artifacts
stored locally by KeepSafe. These may include details about imported
media, timestamps, file names, and user access activity. The parsers can
analyze these artifacts to reveal patterns of use, attempted access, or
deleted content. Such findings can assist in reconstructing timelines,
identifying user intent, and determining whether the application was
used to conceal relevant evidence.
Location of iOS KeepSafe
iOS KeepSafe artifact can be found at the following location:
*private/var/mobile/Containers/Data/Application/<App-GUID>/Library/Application
Support/adjust/adjustIoActivityState
private/var/mobile/Containers/Shared/AppGroup/<App-GUID>/Preference/group.com.keepsafe.keep..Safe.plist
Analyzing iOS KeepSafe Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS KeepSafe
artifacts from iOS machines’ files and what kind of digital forensics
insights we can gain from the artifact.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select iOS
KeepSafe artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS KeepSafe artifacts in ArtiFast.
iOS KeepSafe Albums
- Album Name: The name of the album.
- Album ID: The unique identifier of the album.
- Has Cover: Indicates whether the album has a cover image or not.
- Album Cover: The album cover image in Base64 format.
iOS KeepSafe Preferences
- User ID: The user ID.
- Join Date: The date and time the user joined KeepSafe.
- Last Backup Time: The last backup date and time.
- Launch Count: The total number of times the application was launched.
- Auth Launch Count: The number of launches that required authentication.
- Start Session Time: The date and time when the session started.
iOS KeepSafe Adjust Activity State
- Last Activity Time: The date and time of the last activity on the app.
- Subsession Count: The number of sub-sessions during usage.
- Session Count: The total number of sessions.
- GDPR Forgotten: Indicates whether the user requested to be forgotten under GDPR.
- Time Spent: The total time spent on the app, in seconds.
- Event Count: The number of events recorded by the app.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
