iOS Wire
05/09/2025 Friday
The encrypted communication and collaboration app Wire was created by
Wire Swiss. Wire is available for iOS, Android, Windows, macOS, Linux,
and web browsers, including Firefox. It allows users to communicate
through text messages, voice and video calls, and to share files.
Moreover, this app—similar to its alternatives—offers features like
group chats, conference calls, and synchronization across multiple
devices. Wire also prioritizes user privacy by providing options such as
self-destructing messages and guest access.
Digital Forensics Value of iOS Wire
Wire is currently used by a wide variety of organizations around the
world. The platform is utilized by more than 750,000 businesses. With
its widespread adoption among both individuals and organizations, Wire
becomes a very important tool that should not be missed in digital
forensics investigations. Whether it's an organization's internal or
criminal case investigation, Wire artifacts can be a valuable source of
information. Artifacts such as user messages, channels, and attachments
can be a very rich source of information.
Location of iOS Wire Artifact
Information related to the user’s Wire can be found in the following
locations:
/private/var/mobile/Containers/Shared/AppGroup/<App-GUID>/Accounts/<User-ID>/store/store.wiredatabase
/private/varmobile/Containers/Shared/AppGroup/<App-GUID>/Accounts/<User-ID>
Analyzing iOS Wire Artifact with ArtiFast
This section will discuss how to use ArtiFast to extract iOS Wire
artifacts from iOS and what digital forensic insights we can gain from
them.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select the iOS
Wire artifact.
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Wire artifact in ArtiFast.
iOS Wire Messenger Account Information
- User ID: The user's unique identifier.
- User Name: the account user's display name.
- Email Address: The email addresses registered by this account holder.
- Has Password: Indicates whether the account has a password or not.
- Is Using Company Login: Indicates whether the account is using company login or not.
- Unread Conversation Count: The number of unread conversations.
- Profile Picture: The profile picture’s bytes as Base64.
iOS Wire Messenger Text Messages
- Message Sent Date/Time: Message sending date and time.
- Content: The body of the message.
- Sender ID: ID of the sender.
- Is Delivered: Indicates whether the message was delivered or not.
- Message ID: ID of the message.
iOS Wire Messenger Calls
- Call Date/Time: The date/time when this call was made.
- Call ID: The call's unique identifier.
- Caller ID: The caller's unique identifier.
- Call Duration: The call duration in seconds.
iOS Wire Messenger Locations
- Latitude: Sent location latitude.
- Longitude: Sent location longitude.
- Message Sent Date/Time: Message sending date.
- Sender ID: ID of the sender.
- Message ID: ID of the message.
- Location Title: The text description of this location.
iOS Wire Messenger Images
- Message Sent Date/Time: Message sending date and time.
- Sender ID: ID of the sender.
- Message ID: ID of the message.
- MIME Type: The type of data stored in this file.
- Image ID: ID of the image.
Android Wire Messenger Users
- Activation Date/Time: The user activation date/time.
- Phone Number: The user's phone number.
- Display Name: This user's display name.
- User Name: This user's name.
- Email Address: The email addresses registered by this account holder.
- Activation Longitude: The associated location longitude.
- Activation Latitude: The associated location latitude.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
