Blog >> iOS Microsoft Teams

Investigating iOS Microsoft Teams

22/08/2025 Friday

Microsoft Teams is a unified communication and collaboration platform that is a core component of the Microsoft 365 ecosystem. It provides a centralized hub for workplace chat, video meetings, file storage, and application integration, facilitating teamwork across various organizations. While its primary function is to enhance productivity, its widespread adoption for internal and external communication makes it a rich source of potential evidence.

Digital Forensics Values of iOS Microsoft Teams

Forensic analysis of the iOS Microsoft Teams application can yield a significant volume of valuable evidence, as it stores a wide range of local artifacts. These include cached copies of chat conversations (including message content), user profile information, details of shared locations, and metadata related to call history and meetings. Extracting and parsing this data can be instrumental in reconstructing a user's communications, identifying shared documents, and establishing timelines of collaboration, which is critical for internal investigations, eDiscovery requests, or security incident response.

Location of iOS Microsoft Teams

iOS Microsoft Teams artifact can be found at the following locations:

private/var/mobile/Containers/Shared/AppGroup/<APP_GUID>/SkypeSpacesDogfood/****/SkypeSpacesDogfood-*.sqlite
/private/var/mobile/Containers/Data/Application/<APP_GUID>/Library/Preferences/com.microsoft.skype.teams.plist

Analyzing iOS Microsoft Teams Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract iOS Microsoft Teams artifacts from iOS machines’ files and what kind of digital forensics insights we can gain from the artifact.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Microsoft Teams artifact parsers:

Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Microsoft Teams artifacts in ArtiFast.

iOS Microsoft Teams Call History

• Call Time: The call starting date and time.
• Call Direction: This direction of the call.
• Call Type: This type of call (two-party - group call).
• Call Status: This status of the call.
• Call Oreginator Name: The name of the caller.
• Call Participant Name: The name of the Callee.
• Call Oreginator ID: The ID of the caller.
• Call Participant ID: The ID of the Callee.
• Call Connect: The call connection date and time.
• Call End: The call end date and time.
• Email Address: The email address of this account holder.

iOS Microsoft Teams Text Messages

• Message Date/Time: Message Sending Date/Time.
• Message Base Type: The type of the message.
• Send By Me: Indicates whether the message was sent or received.
• Sender ID: The ID of the message sender.
• Message: The content of this message.
• Receiver Email: Email/s of the message receiver/s.
• Thread ID: The chat ID.
• Thread Type: The conversation type.

iOS Microsoft Teams Shared Locations

• Message Date/Time: Message Sending Date/Time.
• Card URL: The primary URL in the shared card.
• Card URL 2: Additional URL fields in the card content.
• Sender ID: The ID of the message sender.
• Sender Name: The name of the message sender.
• Card Title: The title of the shared card.
• Card Text: The text content of the shared card.

iOS Microsoft Teams User Information

• Display Name:This user's display name.
• Phone Number:This user's phone number.

iOS Microsoft Teams Contacts

• Email Address: The user's email address.
• Display Name: This user's display name.
• Phone Number: This user's phone number.

For more information or suggestions please contact: ekrma.elnour@forensafe.com