pane336

343343IndexNumbers2GiPhone,43Minutessetting,793Gnetwork,72AABGrouptable,49,139,142ABGroupChangestable,49ABGroupMemberstable,49,139,142ABMultiValuetable,49,139,142ABMultiValueEntrytable,49,139,142ABMultiValueEntryKeytable,49ABMultiValueLabeltable,49ABPersontable,49,139,142ABPersonChangestable,49ABPersonMultiValueDeletestable,49ABPersonSearchKeytable,49ABPhoneLastFourtable,49ABRecenttable,49ABStoretable,49ABThumbnailImagetable,144AccelerometeriPadhardware,18AccessDataFTK(ForensicToolkit)toolandimages,306–313overview,303–306SQLitedatabases,313Accountsettings.
plist,113Acquireicon,Lanternapp,94Addbutton,64AddFiles,CocoaSlideShowmenubar,242Address_bccmessageID,165AddressBookdatabase,1,49,142–144AddressBook.
sqlitedb,138Address_ccmessageID,165Address_replyTomessageID,165Address_tomessageID,165AES(AdvancedEncryptionStandard),333AirplaneMode,75–76,323AllApplications,64Allocationfile,34Alternatevolumeheader,35AlwaysOpenWithbox,64analysiswindow,220analytics,191antiforensicapplications,197–206imagevaults,198incognitowebbrowser,200–201invisiblebrowser,201PictureSafe,198–199PictureVault,199–200tigertext,202–206AOLAIM,184AOLInstantMessengerartifacts,184API(applicationprogramminginterface),29AppStore,historyof,19–22AppleMessagePad,1AppleTV,36–37Applev.
Psystar,273–274AppleTV2GiOSdevice,18Applicationdirectory,42Applicationprocessor2Ghardware,11Applicationprocessor3Ghardware,13Applicationprocessor3GShardware,15applicationprogramminginterface(API),29applicationsantiforensic,197–206imagevaults,198incognitowebbrowser,200–201invisiblebrowser,201PictureSafe,198–199PictureVault,199–200tigertext,202–206MacForensicsLabapp,299–303Maps,227–237navigation,260–265Navigon,260–264TomTom,265spyware,317–322FlexiSpy,321Index344MobileSpy,318–321third-party,178–196analytics,191AOLAIM,184Bing,194Craigslist,189–190documentsanddocumentrecovery,194–196Facebook,182–183GoogleMobile,192–193GoogleVoice,186–189iDisk,192LinkedIn,184–185MySpace,185–186Opera,193Skype,180–182socialnetworkinganalysis,180–196Twitter,185artifactsfromMac,209–212changestobackupfiles,211–212lockdowncertificates,212MobileSyncdatabase,210propertylist,209–210fromWindows,212–214iPodDevices.
xml,212–213lockdowncertificates,214MobileSyncbackups,213–214Attributesfile,35Audio2Ghardware,11Audio3Ghardware,13Audio3GShardware,15AudioiPadhardware,16AudioProcessoriPadhardware,18authentication,wireless,333Auto-Locksetting,78–79Autowake.
plist,168BBackUpoption,iTunesapp,91backed-updata,211BackupExtractionWizardinterface,220BackupExtractortool,iPhone,214–216backupfiles,220–225changesto,211–212FTK1.
8tool,222–223FTKImagertool,221tips,223BasebandiPhone4hardware,16Basebandprocessor2Ghardware,11Basebandprocessor3Ghardware,13Basebandprocessor3GShardware,15Berka,J.
,272Bindirectory,42Bing,194Blacklistapplications,250BluetoothiPadhardware,18BodymessageID,165Bookmark.
plist,154–155,230,232–234BrowseDatatab,54–55Browsetab,57BSSIDartifactkey,334B*trees,33buyerbewares,130CCache.
plist,253Cachesdirectory,140–141,144–146Calendarapp,100–101Calendardirectory,140–141CallHistorydatabase,49–52,97,147–148CallHistorydirectory,140–141Callhistorylog,112CallLogdatabase,51Calllogs,97,123Calltable,51CallHistorydatabase,147–148Camera2Ghardware,11Camera3Ghardware,13Camera3GShardware,15Cameraapplication,27,174CameraiPhone4hardware,16CarrierSenseMultipleAccesswithCollisionAvoidance(CSMA/CA),326carving,299–317AccessDataFTKtoolandimages,306–313SQLitedatabases,313EnCasetool,314–317MacForensicsLabapp,299–303casedirectory,Lanternapp,93casenumber,Lanternapp,93Catalogfile,35catalogIDnumbers,34cellphone,trackingindividualby,69Celltable,259celltowerdataGeoHuntertechnology,255–259overview,248–255Index345CellebriteUFED(UniversalForensicExtractionDevice),125–130results,132settingup,126–130supporteddevices,126CellLocationtable,259CellLocationCountstable,259CellLocationHarvestCountstable,259CellLocationLocaBoxes_parenttable,259CellLocationLocaltable,259CellLocationLocalBoxestable,259CellLocationLocalBoxes_nodetable,259CellLocationLocalBoxes_rowidtable,259CellLocationLocalCountstable,259Cells.
plist,249CFAbsoluteTimeConverter,146ClassCprivateaddresses,331Clients-b.
plist,249clients.
plist,259Clients.
plistdatabase,145Clients.
plistpropertylist,145Cocoacomponent,30CocoaSlideShow,241,244com.
apple.
accountsettings.
plistpropertylist,156com.
apple.
AppStore.
plistpropertylist,156com.
apple.
AppSupport.
plistpropertylist,156com.
apple.
commventer.
plstpropertylist,156com.
apple.
compass.
plistpropertylist,156com.
apple.
locationd.
plistpropertylist,156com.
apple.
Maps.
plistpropertylist,157com.
apple.
MobileBluetooth.
devices.
plistpropertylist,157com.
apple.
mobilephone.
settings.
plistpropertylist,157com.
apple.
mobilephone.
speeddial.
plistpropertylist,157com.
apple.
mobilesafari.
plistpropertylist,157com.
apple.
mobiletimer.
plistpropertylist,157com.
apple.
network.
identification.
plist,157,334–335com.
apple.
preferences.
datetime.
plistpropertylist,157com.
apple.
prefernces.
network.
plistpropertylist,157com.
apple.
springboard.
plistpropertylist,157com.
apple.
stocks.
plistpropertylist,157com.
apple.
weather.
plistpropertylist,157com.
apple.
wifi.
plist,157,334com.
apple.
youtube.
plistpropertylist,157comma-separatedvalue(CSV)format,55–56command-linetools,87CommCenterdirectory,47Compassapplicationinterface,240CompassCalibrationtable,259configurationprofiles,149ConfigurationProfilesdirectory,140–141connectionwizard,OxygenForensicSuite2010program,118–119Connectivity2Ghardware,11Connectivity3Ghardware,13Connectivity3GShardware,15Connectivity/80211andGPSiPhone4hardware,16ConnectivityiPhone4hardware,16consolidated.
dbCellLocationtable,145consolidated.
dbfile,145consolidated.
db(iOS4+),335–336Contactdata,123Contactlogs.
dat,319Contactspane,98–99Content_type,162ConversationIDmessageID,165cookies,149–150Cookiesdirectory,140–141cookies.
plistfile,150,201CoreServicescomponent,31Coresdirectory,42CraigPhoneapp,190Craigslist,189–190CSfolder,196CSDatabase.
sqlitefolder,196CSMA/CA(CarrierSenseMultipleAccesswithCollisionAvoidance),326CSV(comma-separatedvalue)format,55–56custody,323–324Cydiaapplication,317DDamagedfilesdirectory,42datfile,105dataacquisition,87–133buyerbewares,130CellebriteUFED,125–130Index346results,132settingup,126–130supporteddevices,126fromiPhone,iPodtouch,andiPad,87–92Lanternapplication,92–107Calendarapp,101calllogs,97Contactspane,98–99directorystructure,107DynamicTextdata,105–106Internethistory,102iPodandmedia,103Mapspane,106messages,99notes,100phoneinformationpane,96photos,103–105results,132Voicemailpane,98OxygenForensicSuite2010program,118–125connectionwizard,118–119dataextractionwizard,120results,131supporteddevices,118viewingbackupdata,121–125ParabenDeviceSeizuretooloverview,115–117results,131support,133SusteenSecureView2tool,107–114acquiringdata,110–111reportingdata,111–114results,132settingupandnavigatinginterface,107–110dataextractionwizard,OxygenForensicSuite2010program,120datapartition,foriOS,46–49Datatable,51DatabaseBrowser,53–55,138,140,143,221,313databaseformat,49DatabaseViewer,SQLite,221dateandtime,photoevidence,82Datevoicemail.
db,163dateMSconversationID,166Dbdirectory,47,61DCRegulatoriPadhardware,18DefenseAdvancedResearchProjectsAgency,325DESalgorithm,43DesktopAccountsfolder,196Developerdirectory,42DeveloperProgram,iPhone,31–32DeviceFirmwareUpdate(DFU),278Deviceinformation,124DeviceSeizure,115–117,131DFU(DeviceFirmwareUpdate),278DHCP(DynamicHostControlProtocol),331–332Dhcpclientdirectory,47Dictionarypane,Lanternapp,106DigitalMillenniumCopyrightAct(DMCA),269–270,272DigitalPerformanceRightinSoundRecordingsAct(DPRA),269DirectionsToHere,229Directions.
plist,234–237Directorydata,125directorystructure,107Display2Ghardware,11Display3Ghardware,13Display3GShardware,15DisplayiPadhardware,18DisplayiPhone4hardware,16DMCA(DigitalMillenniumCopyrightAct),269–270,272.
dmgfiles,223,225DNS(DomainNameService),328,332,338–339DNS/serveraddressesartifact,335Documentsfolder,196documents,recoveryof,194–196DocumentstoGoapp,196DomainNameService(DNS),328,332,338–339downloadingmusiconline,274DPRA(DigitalPerformanceRightinSoundRecordingsAct),269DRAMmemoryiPhone4hardware,16DRM(Digitalrightsmanagement),267–276Applev.
Psystar,273–274DMCA,269–270fairusedoctrine,269–270firstsaledoctrine,269futureof,275–276jailbreakingiPhone,271–272onlinemusicdownloading,274secondaryinfringementliability,270Index347SonyBMGcase,275UnitedStatesConstitution,268–269Durationvoicemail.
db,163DynamicHostControlProtocol(DHCP),331–332DynamicTextdata,105–106dynamic-text.
datfile,150Ee-mail,295–298Exchange,298IMAP,296POP,296–297Eadirectory,47Earthpointoutput,257Earthpointwebinterface,256Elkin-Koren,N.
,268,270–271Elmer-DeWitt,P.
,273Email.
dbstructure,320EMI/RFI-sanitizedroom,324.
emlxfile,297encapsulation,transmittedacrossnetworks,325EnCasetool,194,213,216,221,299,314–317encryption,wireless,333EnterPasscodescreen,77–78Etcdirectory,42Ethernet2,326Evans,J.
,273Exchangee-mails,298EXIF(ExchangeableImageFileFormat),103,114,138,171,237,310ExpirationDatevoicemail.
db,163exportdatafromFroqapplication,59ExportKMLFile,245Exportresultsetscreen,60Extentsoverflowfile,35extractionwizard,120FFacebook,182–183Facestool,174fairusedoctrine,269–270Farley,T.
,67Fencestable,259FileFinderenscript,315–317FileJuicerapp,177,312FileSpyapplication,317filesystem,foriOS,33–36HFS+,33–35HFSX,35–36Filesreport,114FindMyiPadfeature,73FindMyiPhoneservice,72–73firstsaledoctrine,269FirstSortSectionCounttable,49Flag,CocoaSlideShowmenubar,242Flagsvoicemail.
db,163Fletcher,F.
,69FlexiSpyapp,321Foldersdirectory,47forensicanalysis,334–336com.
apple.
network.
identification.
plist,334–335com.
apple.
wifi.
plist,334consolidated.
db(iOS4+),335–336forensictools,220–225FTK1.
8tool,222–223FTKImagertool,221tips,223forensicworkstations,settingup,135–140Foresman,C.
,274FourthAmendmentofU.
S.
Constitution,andsearchandseizure,68–69Froqapplication,56,58–59,140,153fstabfile,41FTK1.
8tool,222–223FTK(ForensicToolkit)toolandimages,306–313SQLitedatabases,313FTKImagertool,221GGenerallog,292Geo-locationdata,227Geodata,enteredintoGoogleMaps,231GeoHuntertechnology,255–259geospatialmetadata,237geotaggedEXIFdata,239geotaggingimages,andvideos,237–248Gershowitz,A.
,69–72GetInfodialogbox,63GetInfooption,222Gmailaccountcontactinformation,189GoogleMapbutton,CocoaSlideShow,243GoogleMaps,6,103,130,172,236,241–243Index348GoogleMobile,192–193GoogleVoice,186–189GoogleDocDatabase.
sqlitefolder,196GPGGAdata,261GPRMCvalues,261GPS3Ghardware,13GPS3GShardware,15GPScoordinates,172–173GPSdata,114,171–172,303GPS(GlobalPositioningSystem),227–265celltowerdataGeoHuntertechnology,255–259overview,248–255geotaggingimagesandvideos,237–248Mapsapplication,227–237navigationapplications,260–265Navigonapp,260–264TomTomapp,265GPSVisualizer,257–258GPSBabelapp,262–264Gpslog.
dat,319GPSLog.
dayfile,319graphicaluserinterface(GUI),1,51,87,103,139Graphics2Ghardware,11Graphics3Ghardware,13Graphics3GShardware,15Groenenboom,M.
,267,276GUI(graphicaluserinterface),1,51,87,103,139GUItools,Mac,177GyroscopeiPhone4hardware,16HH-cells.
plist,250–251H-Wifi.
plist,252–253hackers,ofiPhone,22Hafner,K.
,70hardware,internalforiPad,16–17foriPhone2G,9–11foriPhone3G,12–13foriPhone3G[S],14–15foriPhone4,15–16Harwood,E.
D.
,268–269,274hasAttachmentconversationID,166hasAttachmentmessageID,165Hayes,D.
,271–272Hdiutilprogram,37Helberger,N.
,267,276Henderson,S.
,68–69HFS+(HierarchicalFileSystem),33–36HFSvolume,33,40HFSX,filesystemforiOS,35–36HierarchicalFileSystem(HFS+),33–36Hinkes,E.
M.
,269–270historyofApplemobiledevices,1–23andAppStore,19–22iPad,8iPhone2G,3–5competitiveadvantages,5webappsfor,4iPhone3G,5–6iPhone3G[S],6–7iPhone4,7iPhonehackers,22iPod,2ROCKR,2–3history.
plist,158,230homescreen,iPhone,26HTC,5HTMLreport,128HTTP(HypertextTransferProtocol),330,340https_www.
google.
com_0directory,167Huges,N.
,273HypertextTransferProtocol(HTTP),330,340IIdentifierartifact,335iDevicebackups,214–220iPhoneBackupExtractortool,214–216JuicePhoneapp,216–217mdhelperapp,218–219OxygenForensicsSuite2010program,219–220iDisk,192IEEE(InstituteofElectricalandElectronicsEngineers),324iEraseapp,197Imagedirectionreference,241ImageEXIF,307imagevalidation,284imagevaults,198imagesAccessDataFTKtool,306–313geotagging,237–248IMAP(InternetMessageAccessProtocol),296Index349incognitowebbrowser,200–201info.
plist,138InspectorGPSdata,240InstituteofElectricalandElectronicsEngineers(IEEE),324internalhardwareforiPad,16–17foriPhone2G,9–11foriPhone3G,12–13foriPhone3G[S],14–15foriPhone4,15–16Internetbookmarks,102Internethistory,102InternetMessageAccessProtocol(IMAP),296InternetProtocol(IP),327invisiblebrowser,201iOS,25–66developmentofapplicationsfor,31–33featurecomparisonsfor,25–31iOS1,25–27iOS2,27–28iOS3,28–29iOS4,29–31filesystem,33–36HFS+,33–35HFSX,35–36partitionandvolumeinformation,36–49datapartition,46–49OSpartition,41systempartition,41–45propertylistsin,61–66SQLitedatabasesin,49–66AddressBookdatabase,49CallHistorydatabase,50retrievingdatafrom,53–60SMSdatabase,50IPaddress,328,339IPheader,328IP(InternetProtocol),327iPaddataacquisition,87–92historyof,8internalhardwarefor,16–17iPad3G+WiFiiOSdevice,18iPadWiFiiOSdevice,18iPhonedataacquisition,87–92jailbreaking,271–272iPhone2Ghistoryof,3–5competitiveadvantages,5webappsfor,4internalhardwarefor,9–11iPhone3Ghistoryof,5–6internalhardwarefor,12–13iPhone3G[S]historyof,6–7internalhardwarefor,14–15iPhone4historyof,7internalhardwarefor,15–16iPhoneBackupExtractortool,214–216iPhoneDeveloperProgram,31–32iPhonehomescreen,26iPhoneTwitterapplication,179iPhotophotos,176–177iPod,historyof,2iPodTouch1GiOSdevice,18iPodTouch2GiOSdevice,18iPodTouch3GiOSdevice,18IPodTouch4GiOSdevice,18iPodTouch,dataacquisition,87–92iPodDevices.
xml,212–213IPv4/addressesartifact,335IPv4/routerartifact,335IPv4/subnetmasksartifact,335Irfanview,308–309isinboxconversationID,166isinboxmessageID,165isolatingdevice,fromnetworks,75–77isStarredconversationID,166isStarredmessageID,165isUreadconversationID,166isUreadmessageID,165.
ithmbfiles,138,311iTunes,3,121,177–178iXAMtool,277–283Jjailbreakmethods,284jailbreakingiPhone,271–272overview,207jailbrokeniPhones,identifying,79–80JohntheRippertool,43JPEGs,302,304JuicePhoneapp,216–217Index350KKerr,O.
,71Keycolumn,64–65keylogger,150keyboard,150–152Keyboarddirectory,140–141Keychaindirectory,47,61keywordsearch,inTextEdit,151Keywordsearchoption,100KMLexport,245–247KMLfile,244LLabriola,D.
,267–268Lanternapplication,92–107Calendarapp,101calllogs,97Contactspane,98–99directorystructure,107DynamicTextdata,105–106Internethistory,102iPodandmedia,103Mapspane,106messages,99notes,100phoneinformationpane,96photos,103–105results,132Voicemailpane,98Lastvisiteddatevalue,158lastAutoJoinedartifactkey,334lastJoinedartifactkey,334Latitudehistory.
plist,230NorthPolesettings,241Lawinski,J.
,273LEDDriveriPadhardware,18LEDflash,7Library/AddressBookdirectory,48Library/Caches/Com.
apple.
itunesstoreddirectory,48Library/Cachesdirectory,48Library/Calendardirectory,48Library/CallHistorydirectory,48Library/CarrierBundlesdirectory,48Library/ConfigurationProfilesdirectory,48/library/configurationProfiles/Passwordhistory.
plist,295Library/Cookiesdirectory,48Library/DataAccessdirectory,48Librarydirectory,43Librarydomain,140–167AddressBookdatabase,142–144Cachesdirectory,144–146callhistorydatabase,147–148configurationprofiles,149cookies,149–150keyboard,150–152Logsdirectory,152–154Maphistory,155Mapsapp,154–155Notesdatabase,156Preferencesfolder,156–157Safaribrowser,157–158SMSandMMSdatabases,160–162SuspendedStateproperty,159–160voicemails,162–163WebClipsfolder,163–164WebKitsfolder,164–167Library/Keyboarddirectory,48Library/Logsdirectory,48Library/Maildirectory,48Library/Mapsdirectory,48Library/Mobileinstallationdirectory,48Library/Notesdirectory,48Library/Preferences/com.
rxs.
smartphoneplist,318Library/Preferencesdirectory,48librarypropertylist,210Library/RemoteNotificationdirectory,48Library/Safaridirectory,48,61Library/SafeHarbordirectory,48Library/SMSdirectory,48Library/Voicemaildirectory,48Library/Webclipsdirectory,48Library/WebKitdirectory,48LinkedIn,184–185Locatebutton,GPSdatabox,172LocationHarvesttable,259Locationtable,259lockpasscode,remote,75LockBackground.
jpgdirectory,140–141lockdowncertificatescopyingfromcomputer,84overview,212–214Lockdownfolder,84Logdirectory,47logicaldataanalysis,135–207antiforensicapplicationsandprocesses,197–206Index351imagevaults,198incognitowebbrowser,200–201invisiblebrowser,201PictureSafe,198–199PictureVault,199–200tigertext,202–206jailbreaking,207Librarydomain,140–167AddressBookdatabase,142–144Cachesdirectory,144–146callhistorydatabase,147–148configurationprofiles,149cookies,149–150keyboard,150–152Logsdirectory,152–154Maphistory,155Mapsapp,154–155Notesdatabase,156Preferencesfolder,156–157Safaribrowser,157–158SMSandMMSdatabases,160–162SuspendedStateproperty,159–160voicemails,162–163WebClipsfolder,163–164WebKitsfolder,164–167MediaDomain,170–178iPhotophotos,176–177Mediadirectory,170–175multimedia,177–178PhotosAux.
sqlitedatabase,175Photos.
sqlitedatabase,175recordings,176settingupforensicworkstations,135–140SystemConfigurationdata,168–170third-partyapplications,178–196analytics,191AOLAIM,184Bing,194Craigslist,189–190documentsanddocumentrecovery,194–196Facebook,182–183GoogleMobile,192–193GoogleVoice,186–189iDisk,192LinkedIn,184–185MySpace,185–186Opera,193Skype,180–182socialnetworkinganalysis,180–196Twitter,185Logsdirectory,152–154Longitudehistory.
plist,230NorthPolesettings,241Lyon,M.
H.
,269,274–276MMacartifactsfrom,209–212changestobackupfiles,211–212lockdowncertificates,212MobileSyncdatabase,210propertylist,209–210reviewingexploitedmedia,291–295MACaddresses,326MacGUItools,177MacForensicsLabapp,299–303MacFUSE,40Mailapplication,295ManagedPreferencesdirectory,47,61Manifestpropertylist,293Maphistory,155Mapsapplication,154–155,227–237Mapsbookmarks,155Mapsdata,106Mapsdirectory,140–141Mapspane,106Maptiles,295MCDataMigration.
plist,149McDougall,P.
,273.
mdbackupfiles,211mdhelperapp,88–92,218–219Media/Booksdirectory,49Mediacomponent,30Media/DCIMdirectory,48Mediadirectory,170–175MediaDomain,170–178iPhotophotos,176–177Mediadirectory,170–175multimedia,177–178PhotosAux.
sqlitedatabase,175Photos.
sqlitedatabase,175recordings,176mediaexploitation,267–289,291–322carving,299–317AccessDatatool,303–313EnCasetool,314–317MacForensicsLabapp,299–303DRM,267–276Index352Applev.
Psystar,273–274DMCA,269–270fairusedoctrine,269–270firstsaledoctrine,269futureof,275–276jailbreakingiPhone,271–272onlinemusicdownloading,274secondaryinfringementliability,270SonyBMGcase,275UnitedStatesConstitution,268–269e-mail,295–298Exchange,298IMAP,296POP,296–297imagevalidation,284reviewingexploitedmediausingMacs,291–295spywareapplications,317–322FlexiSpy,321MobileSpy,318–321tools,277–284iXAM,277–283otherjailbreakmethods,284Media/iTunes_Controldirectory,48Media/PhotoDatadirectory,48Memory2Ghardware,11Memory3Ghardware,13Memory3GShardware,15MemoryiPadhardware,18MemoryiPhone4hardware,16MessagePad,Apple,1Message_id,162messages,99mini-SIMcard,77,79MMSdata,99MMSdatabase,160–162Mobile/Applicationdirectory,48Mobiledirectory,47Mobileinstallationplist,293Mobile/Library/Caches/Safari/Thumbnails,294Mobile/Library/Caches/snapshots,294Mobile/library/Cookiesdirectory,61Mobile/Library/Maildirectory,61Mobile/Library/Preferencesdirectory,61Mobile/Librarycom.
apple.
mobile.
installation.
plist,293Mobile/Library.
Mapsdirectory,61MobileSafaribrowser,149MobileSpyapplication,318–321MobileDevicedirectory,47MobileInstallationdirectory,140mobile.
installation.
plist,294MobileMeaccount,72,192MobileSyncbackups,213–214MobileSyncdatabase,176,209–210ModifyDateMsconversationID,166MotorolaDroid,5MOVfiles,247–248Movetotrash,CocoaSlideShowmenubar,242Mow,L.
,69/Msdeamondirectory,Contactlogs.
dat,319Msg_group,50Msg_Pieces,50msg_piecestable,162multimedia,177–178music,downloadingonline,274MySpace,185–186NNAT(NetworkAddressTranslation),331–332NationalInstituteofStandardsandTechnology(NIST),277navigationapplications,260–265Navigon,260–264TomTom,265Navigonapp,260–264NetworkAddressTranslation(NAT),331–332networkanalysis,323–342custody,323–324DHCP,331–332forensicanalysis,334–336com.
apple.
network.
identification.
plist,334–335com.
apple.
wifi.
plist,334consolidated.
db(iOS4+),335–336networktrafficanalysis,337–342wirelessencryptionandauthentication,333Networkprotocols,330networktrafficanalysis,337–342Network.
identification.
plist,168–169networks,isolatingdevicefrom,75–77Neversetting,79Newton,1–2NIST(NationalInstituteofStandardsandTechnology),277Index353NorthPolesettings,Compassapplication,241notes,100Notesdatabase,156Notesdirectory,140–141Notespane,100Notestable,156Numbersdirectory,195numMessagesconversationID,166OOmniOutlinerapplication,62,64–65onlinemusic,downloading,274Openicon,53Opera,193OSXkernelcomponent,31Oxygenconnectionwizard,118,121–122,125OxygenForensicSuite2010program,118–125connectionwizard,118–119dataextractionwizard,120results,131supporteddevices,118viewingbackupdata,121–125OxygenForensicsSuite2010program,219–220PPagesfiles,analyzing,194ParabenDeviceSeizuretooloverview,115–117results,131partitions,foriOS,36–49datapartition,46–49OSpartition,41systempartition,41–45Partssubdirectory,162passcodelock,turningoff,77–79PCAPfile,341phoneinformationpane,96PhoneSetupWizard,108photos,103–105Photospane,104PhotosAux.
sqlitedatabase,175Photos.
sqlitedatabase,175PictureSafeapplication,198–199PictureVaultapp,199–200PinchMedia,191PListEditor,221plists(propertylists),87pmapoption,37POI(pointsofinterest),227POP(PostOfficeProtocol),296–297PowerampiPhone4hardware,16/Preferences/com.
rxs.
msdaemon.
plist,318Preferencesfolder,47,140–141,156–157Preferencesmenu,iTunesapp,89Preferences.
plist,169–170PreventiPodsandiPhonesfromsyncingautomaticallyoption,iTunesapp,90Previewapplication,103,238Preview_id,162Primarykey,175privatedirectory,43ProcessoriPadhardware,18ProcessoriPhone4hardware,15propertylist,209–210PropertyListEditorapplication,62,64,138,146,149,155,232–234propertylists,iniOS,61–66Pwnage,80QQuickTimegeodata,248Qwkpwn,80RRadio/amplifieriPhone4hardware,16Radio/transmitandreceiveriPhone4hardware,16RAMiPadhardware,18RAWdisk,41ReadBackupsbutton,215ReceiveddateMSmessageID,165RecommendedApplications,64RecordingIndustryAssociationofAmerica(RIAA),274recordings,176RecordModDate,175RecoverediPhoneFiles,91,140RemoteNotificationdirectory,140remoteuser,74remotewipe,72Index354remotelylockingdevice,72–75remotelywipingdevice,72–75Remove,CocoaSlideShowmenubar,242reportmode,selecting,116ResearchinMotion(RIM),5RFC1122,325,328RIAA(RecordingIndustryAssociationofAmerica),274RIM(ResearchinMotion),5Roberts,M.
,71ROCKR,historyof,2–3Rootdirectory,47Rosenblatt,B.
,268–270RotateLeft,CocoaSlideShowmenubar,242RotateRight,CocoaSlideShowmenubar,242ROWID(rowidentification),50,160,162Rundirectory,47SSafariapp,102Safaribrowser,102,157–158Safaridirectory,141–142SafariHistorypropertylist,158Salvageinterface,300,302SaveAsdialogbox,341sbindirectory,43SDK(SoftwareDevelopmentKit),6,27searchandseizure,67–86collectinginformationfromiPhone,80–83copyinglockdowncertificatesfromcomputer,84andFourthAmendmentofU.
S.
Constitution,68–69identifyingjailbrokeniPhones,79–80incidenttoarrest,69–71iPhoneisconsideredcellphone,71–72isolatingdevicefromnetworks,75–77andremotelylockingdevice,72–75andremotelywipingdevice,72–75trackingindividualbycellphone,69turningoffpasscodelock,77–79Search.
dbfolder,196secondaryinfringementliability,270SecureView2homescreen,108SenderandCallback_numvoicemail.
db,163senderListHTMLconversationID,166Sensors2Ghardware,11Sensors3Ghardware,13Sensors3GShardware,15SetDirectory,CocoaSlideShowmenubar,242Settingsicon,78ShreditHDapp,198SIMcard,77,79SkypeAnalyzer,182Skypeapplication,180–182SkypeLogView,181Slideshow,CocoaSlideShowmenubar,242SMSdata,99,124SMSdatabase,50,160–162SMSdirectory,141–142SMSmessages,111,161,299SMS.
dbfile,161,299smslog.
datfile,320SnippetHMTLconversationID,166SnippetHMTLmessageID,165socialnetworkinganalysis,180–196SoftwareDevelopmentKit(SDK),6,27SonyBMGcase,275spywareapplications,317–322FlexiSpy,321MobileSpy,318–321SQlitecommands,139SQLiteDatabaseBrowser,53–55,138,140,143,313SQLiteDatabaseViewer,221SQLitedatabases,49–66,313AddressBookdatabase,49CallHistorydatabase,50retrievingdatafrom,53–60SMSdatabase,50_SqliteDataBaseProperties,50SqliteDatabasePropertiestable,51Sqlite_sequencetable,49–51SSID_STRartifactkey,334Startupfile,35Stillwagon,B.
,68–69Storage2Ghardware,11Storage3Ghardware,13Storage3GShardware,15Strengthartifactkey,334Stringvalue,158SubjectconversationID,166SubjectmessageID,165SuspendedStateproperty,159–160SusteenSecureView2tool,107–114acquiringdata,110–111reportingdata,111–114results,132Index355settingupandnavigatinginterface,107–110SystemConfigurationdata,168–170SystemConfigurationdirectory,141Systemdirectory,43systeminformation,photoevidence,83/System/Library/LaunchDaemons/com.
rxs.
ms.
plist,318systempartition,foriOS,41–45SystemProfilesdirectory,149TTabledrop-downlist,54TableInfotable,259Tang,P.
,269–270TCP(TransportControlProtocol),328,330TextEditapplication,41,211–212,233third-partyapplications,178–196analytics,191AOLAIM,184Bing,194Craigslist,189–190documentsanddocumentrecovery,194–196Facebook,182–183GoogleMobile,192–193GoogleVoice,186–189iDisk,192LinkedIn,184–185MySpace,185–186Opera,193Skype,180–182socialnetworkinganalysis,180–196Twitter,185tigertextapp,202–206tigertextdatabase,204–206Timestampartifact,335Timestamp,NorthPolesettings,241Tmpdirectory,42,47TomTomapp,265TouchscreeniPadhardware,16trackingindividual,bycellphone,69TransportControlProtocol(TCP),328,330Trasheddatevoicemail.
db,163TV,Apple,36–37Twitter,185UUDP(UserDatagramProtocol),328UFED(UniversalForensicExtractionDevice),125–130settingup,126–130supporteddevices,126UI(userinterface),26UniformResourceLocator(URL),113,158UnitedStatesConstitution,268–269UNIXjail,41UNIXtime,33,50URL(UniformResourceLocator),113,158USB2Ghardware,11USB3Ghardware,13USB3GShardware,15UserDatagramProtocol(UDP),328Userdirectory,42userinterface(UI),26userLabelIdsconversationID,166Usrdirectory,43VValuecolumn,64–65Vardirectory,42Videogeotagdata,247videos,geotagging,237–248Vmdirectory,47Voicememos,176Voicemaildata,163Voicemaildirectory,141–142Voicemailpane,98voicemail.
db,163voicemails,162–163Volumeheader,34WWebapps,andhistoryofiPhone2G,4web-basedMobileMeaccount,74webinterface,Earthpoint,256Webclipdirectory,141–142WebClipsfolder,163–164WebClipsinfo.
plistdata,164WebKitdirectory,141–142,164–167,187–188WEP(WiredEquivalentPrivacy),333Wi-FiProtectedAccess(WPA),333WiFiLocationHarvesttable,259WiFitable,259Index356WifiLocationtable,259WiFiLocationHarvestCountstable,259Wifi.
plist,169Windowsartifactsfrom,212–214iPodDevices.
xml,212–213lockdowncertificates,214MobileSyncbackups,213–214forensictoolsandbackupfiles,220–225FTK1.
8tool,222–223FTKImagertool,221tips,223Windows7,88,214Windowscommand-linetools,177WindowsVista,88,214WindowsXP,88,214WiredEquivalentPrivacy(WEP),333wirelessencryptionandauthentication,333Wiresharkfilter,340–341WPA(Wi-FiProtectedAccess),333X,Y,ZXMLfiles,61–62XMLplistformat,149