99 - Sample Exam iOS

Question 1

iOS Forensics - Contacts

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 1

1. Addressbook.sqlitedb & AddressbookImages.sqlitedb
2. ABPerson (rowid, last, first)
   * *ABMultiValue** (record_id, label)
   * *ABMultivalueEntry** (parent_id)
   * *ABMultiValueLabel** (rowid)
3. look above
4. NSDate: +978’307’200

Question 2

iOS Forensics - Call History

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 2

1. call_history.db
2. call
3. Rowid
   Address
   Date
   Duration
   Flags (4=incoming, 5=outgoing, 8=blocked, 16=FaceTime, Else=Dropped)
4. unixepoch

Question 3

iOS Forensics - Chats

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 3

1. ChatStorage.sqlite
2. zwamessage
3. ZMESSAGEDATE
   ZTEXT
4. NSDate: +978’307’200

Question 4

iOS Forensics - Calendar

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 4

1. Calendar.sqlitedb & Extras.db
2. Alarm, Event, ZALARM
3. -
4. NSDate: +978’307’200

Question 5

iOS Forensics - SMS

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 5

1. sms.db
2. message
   msg_group
   group_member
   sqlite_sequence
   msg_pieces
3. ROWID
   Address
   date
   text
   flags (2=received, 3=sent, 129=deleted)
4. unixepoch

Question 6

iOS Forensics - Location

Name the following:

1. Important databases
2. Important tables
3. Important fields / flags (if any)
4. Timestamp used

Answer 6

1. consolidated.db
2. CellLocation & WifiLocation
3. Latitude, Longitude, Timestamp
4. NSDate: +978’307’200

Question 7

iOS Forensics - Contacts

What is the path of the db file(s)?

Answer 7

/private/var/mobile/Library/Addressbook/

Question 8

iOS Forensics - Call History

What is the path of the db file(s)?

Answer 8

/var/wireless/Library/CallHistory

Question 9

iOS Forensics - Chats

What is the path of the db file(s)?

Answer 9

/private/var/mobile/Containers/Shared/AppGroup

Question 10

iOS Forensics - Calendar

What is the path of the db file(s)?

Answer 10

/private/var/mobile/Library/Calendar/

Question 11

iOS Forensics - SMS

What is the path of the db file(s)?

Answer 11

/var/mobile/Library/SMS/

Question 12

iOS Forensics - Location

What is the path of the db file(s)?

Answer 12

/Library/Caches/locationd