Blog >> iOS Facebook Messenger

Investigating iOS Facebook Messenger

25/11/2022 Friday

Facebook Messenger is a cross platform instant messaging application from Meta. Facebook Messenger is the main instant messaging application for Facebook, Instagram, Portal, and Oculus (yet to be released). The application provides users with the ability to exchange messages, media, files, and supports voice and video, These features available in private chats as well as group chats.

Digital Forensics Value of iOS Facebook Messenger

Meta (used to be known as Facebook), one of the most known social media platform products and service providers. Messenger is the main messaging application for Facebook, Instagram, two of the most used platforms, in additions to two other platforms yet to be released. The application is one of the most downloaded and used in its category which makes it an important source of information during investigations.

Location of iOS Facebook Messenger Artifacts

In the latest version of Messenger ( v 368.0.0 ), - the artifacts are stored in - the following path :

Whereas previously it was stored in the following location :
private\var\mobile\Containers\Shared\AppGroup\A7595D29-7E75-4EE0-9D42-29F19B95B275\Library\Application Support\lightspeed-userDatabases\ ****.db

**** Represents the user’s ID

Analyzing iOS Facebook Messenger Artifacts with ArtiFast

This section will discuss how to use ArtiFast to extract Facebook Messenger from iOS m and what kind of digital forensics insight we can gain from the artifacts.

After you have created your case and added evidence for the investigation, at the Artifact Selection phase, you can select iOS Facebook Messenger artifacts:

Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Facebook Messenger artifacts in ArtiFast.

iOS Facebook Messenger Messages Artifact

iOS Facebook Messenger Contacts Artifact

iOS Facebook Messenger Calls Artifact

iOS Facebook Messenger Rooms Artifact

iOS Facebook Messenger Attachments Artifact

iOS Facebook Messenger Threads Artifact

For more information or suggestions please contact: [email protected]