iOS Network Forensics

Question 1

Checkm8 definition

Answer 1

Exploit that makes a full file system extraction possible.

Question 2

Checkra1n definition

Answer 2

Utilising the checkm8 exploit in forensics is
achieved using Checkra1n

Question 3

Wi-Fi and cell site location files in iOS

Answer 3

plistprivate/var/root/Library/Caches/location/cache_encrypte dB.db

/private/var/root/Library/Caches/com.apple.wifid/ThreeBars.sqlite

/private/var/root/Library/Caches/com.apple.routined/Cache.sqlite

locationd_cacheencryptedAB_celllocation.txt

Question 4

Iphone backup location

Answer 4

/private/var/mobile/Library/Preference/com.apple.mobile.ldbackup.plist

Question 5

iOS files of interest

Answer 5

CallHistoryDB
CrashReporter
Wi-Fi Subfolder
SMS Folder
KnowledgeC.db - Database on application usage