Information Technology Reference
In-Depth Information
Important plist files
Raw disk images or the backup that you extracted in
Chapter 3
,
Data Acquisition from iOS
Devices
, and
Chapter 4
,
Data Acquisition from iOS Backups
, will contain the following
plist files that are important for an investigation. The files shown are extracted from an iOS
6 device. The file locations may vary for your iOS version.
The HomeDomain plist files
The following are the
HomeDomain
plist files, which contain data that may be relevant to
your investigation:
•
/private/var/mobile/Library/Preferences/
com.apple.mobilephone.plist
: This contains the last phone number
entered into the dialer regardless of whether it was dialed or not
•
/private/var/mobile/Library/Preferences/
com.apple.mobilephone.speeddial.plist
: This contains a list of the
contacts that were added to the phone's favorite list
•
/private/var/mobile/Library/Preferences/
com.apple.accountsettings.plist
: This contains a list of the e-mail
accounts configured on the device
•
/private/var/mobile/Library/Preferences/
com.apple.AppSupport.plist
: This contains the country code used for the
App Store on the device
•
/private/var/mobile/Library/Preferences/
com.apple.Maps.plist
: This contains the last latitude, longitude, and ad-
dress pinned in the Maps application
•
/private/var/mobile/Library/Preferences/
com.apple.mobilemail.plist
: This contains the e-mail fetching dates and
e-mail signatures used
•
/private/var/mobile/Library/Preferences/
com.apple.mobiletimer.plist
: This contains a list of world clocks used
•
/private/var/mobile/Library/Preferences/
com.apple.Preferences.plist
: This contains the keyboard language that
was last used on the device
•
/private/var/mobile/Library/Preferences/
com.apple.mobilesafari.plist
: This contains a list of the recent
searches made through Safari
