Information Technology Reference
In-Depth Information
Contents of the IsolatedStore folder
By analyzing these folders, a forensic analyst can gather a lot of information that could
aid in the investigation. The following are some of the findings from our Facebook app
analysis example:
• The file
userid.settings
shown in the following screenshot contains the
user's profile name and a link to the user's profile and profile picture.
• All the pictures used by the Facebook app are stored in the
Images
folder
present in the directory
IsolatedStore
. To view the images, change the ex-
tension of the files to
JPG
.
• The
DataCache.userID
folder contains most of the information about the
Facebook account. By parsing this folder, information about friends, friend re-
quests, messages, and more can be obtained. This is straightforward as all the
files, once extracted, can be manually examined for relevance to the investigation.
