Investigating iOS TextMe
21/02/2025 Friday
The Text Me app on iOS is a free messaging and calling application that allows users to send SMS, MMS, and make voice or video calls over the internet. It provides an alternative to traditional carrier-based messaging and calling by utilizing Wi-Fi or mobile data to facilitate communication. One of the standout features of Text Me is its ability to assign users multiple dedicated phone numbers. Additionally, Text Me allow its users to add calling capabilities to their iPads. This means that users can turn their iPad into a fully functional phone by making and receiving calls without the need for a SIM card.
Digital Forensics Values of iOS TextMe
The Text Me app holds significant forensic value due to its ability to provide users with temporary or secondary phone numbers, enabling anonymous or untraceable communication. This feature can be misused for fraud, scams, or other illicit activities. As a result, analyzing the artifacts left behind by the app may help investigators trace illegal activities, uncover communication patterns, and identify potential suspects.
Location of iOS TextMe
iOS TextMe artifact can be found at the following locations:
*/TextMe2.sqlite
*/bc21601b38f00eb97dc6ce6d73862decab2371d5
Analyzing iOS TextMe Artifacts with ArtiFast
This section will discuss how to use ArtiFast to extract iOS TextMe artifacts from iOS machines’ files and what kind of digital forensics insights we can gain from the artifact.
After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS TextMe artifact parsers:
×
Once ArtiFast parsers plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS TextMe artifacts in ArtiFast.
iOS Text Me Contacts
- Sign Up Date: The date when the user sign up to the app.
- First Name: The First name of the user.
- Last Name: The Last name of the user.
- User Name: The Username chosen by this user to be used in the app.
- User Email: The User Email address.
- Picture URL: The profile picture URL.
- Picture Last Update Date: The Picture Last Update Date.
- User Gender: User gender.
- Country: The country where the user is living.
- Is Currently Logged In: Indicates whether the user is currently logged in or not.
- Remote ID: Remote ID.
- Is Email Verified: Indicates whether the registration email has been verified or not.
- Text Me Credit: Text Me credit.
iOS Text Me Calls
- Start Date: The call Start Date.
- End Date: The call End Date.
- Call Display Name: Call Display Name.
- Is Inbound: Indicates whether this call is inbound or not.
- Call To: The call partner for outgoing calls.
- Call From: The call partner for incoming calls.
- Call Status: Call status.
iOS Text Me Users
- Sign Up Date: The date when the user signed up to the app.
- First Name: The first name of the user.
- Last Name: The last name of the user.
- User Name: The username chosen by this user to be used in the app.
- User Email: The user's email address.
- Picture URL: The profile picture URL.
- Picture Last Update Date: The last update date of the profile picture.
- User Gender: User's gender.
- Country: The country where the user is living.
- Is Currently Logged In: Indicates whether the user is currently logged in or not.
- Remote ID: Remote ID.
- Is Email Verified: Indicates whether the registration email has been verified or not.
- Text Me Credit: Text Me credit.
iOS Text Me Messages
- Message Date: The date when this message has been sent/received.
- Message Body: The content of the message.
- Message GUID: Message GUID.
- Message Remote ID: Message Remote ID.
- Sender User Name: The message sender's user name.
- Message Participants: Message participants.
- Is Call: Indicates whether this message is a call or not.
- Has Attachment: Indicates whether this message has attachments or not.
- Attachment Type: Attachment type.
- Attachment Name: Attachment name.
iOS Text Me Discussions
- Discussion Title: Discussion title.
- Discussion Participants: Discussion participants.
- Discussion Last Message: Discussion last message.
- Discussion ID: Discussion ID.
- Phone Number: Phone number.
- Is Blocked Discussion: Indicates whether the discussion is blocked or not.
- Is Hidden Discussion: Indicates whether the discussion is hidden or not.
- Unread Count: Number of unread messages.
- Muted Until: The date and time until the discussion is muted.
For more information or suggestions please contact: kalthoum.karkazan@forensafe.com
