iOS Data Analysis and Recovery - Practical Mobile Forensics - page 174

Downloaded applications
Third-party applications, which are downloaded and installed from the App Store, include
applications such as Facebook, WhatsApp, Viber, Wickr, Skype, and GMail, and more that
contain a wealth of information useful for an investigation. Some third-party applications
use the Base64 encoding, which needs to be converted for viewing as well as encryption.
Applications that encrypt the database file prevent the examiner from accessing the data
residing in the tables. Encryption varies amongst these applications based on the applica-
tion and iOS versions.
A unique subdirectory GUI is created for each application installed on the device in the
/private/var/mobile/Applications/ directory, which is shown in the follow-
ing example. Also, the hierarchical structure of the Applications directory is shown.
Most of the files stored in the application's directory are in the SQLite and plist format:
$tree -L 2 /var/mobile/Applications/
/var/mobile/Applications/
|-- 08E03CB2-26A5-4DAF-9843-3893AF4EDDF0
| |-- Documents
| |-- Library
| |-- WordPress.app
| |-- iTunesArtwork| |-- iTunesMetadata.plist
| `-- tmp
|-- 0922F95C-7E40-4075-BC5A-06CE829BDD9E
| |-- Documents
| |-- Library
| |-- Wickr.app
| |-- iTunesArtwork
| |-- iTunesMetadata.plist
| `-- tmp
|-- 11C7F3E9-A10E-405D-B6BB-2F86B1B2400F
| |-- Documents
| |-- Library
| |-- photovault.app
| `-- tmp