Magnet AXIOM Artifacts

Magnet AXIOM sorts parsed data into artifact categories (Communication, Media, Web Related, Operating System, Location & Travel, Encryption & Credentials, Application Usage). This deck lists the core artifacts, where each comes from on iOS and Android, and what it shows. The backup structure behind these paths is in L04.

Core ArtifactsSearch on YouTubeBookmarkSaved

• iOS owner information: from Info.plist, and OS info in the artifacts.
• Android Device Information artifact: in the APPLICATION USAGE category.
• Accounts Information: the OPERATING SYSTEM category pulls it using Dumpsys, which extracts data about system services running on the device. It is saved in account.txt under the Live Data\Dumpsys Data path in the Quick Image.
• Many packages do not store a unique username (for example, Messenger).
• Third-party apps may not be part of the backup. Knowing which apps are installed still helps: it supports a cloud service search warrant.

Communication ArtifactsSearch on YouTubeBookmarkSaved

iOS ContactsSearch on YouTubeBookmarkSaved

• iOS-style backups store the device's contacts in AddressBook.sqlitedb.
• Location: HomeDomain/Library/AddressBook.

iOS Call LogsSearch on YouTubeBookmarkSaved

• Stored in the SQLite database CallHistory.storedata under HomeDomain-Library/CallHistoryDB/.
• Most forensically relevant data is in the table ZCALLRECORD.

Mac Absolute time counts seconds since 1 January 2001 00:00:00 UTC. Unix time counts from 1 January 1970. So:

Android Call LogsSearch on YouTubeBookmarkSaved

• Recovered from a file called com.android.calllogbackup.data in adbdata.tar\apps\com.android.calllogbackup\k\.
• Or from a database called calllog.db stored in the Live Data of the Quick Image.

AXIOM's call log artifact shows these fields:

iOS iMessage, SMS and MMSSearch on YouTubeBookmarkSaved

• Stored in sms.db in /HomeDomain/Library/SMS.
• Practical: explore iOS messages in AXIOM (tables such as message, chat, handle, attachment).

Gallery and Media FilesSearch on YouTubeBookmarkSaved

• iOS is restrictive about where saved media goes. Android lets the user store media on an SD card (if present).
• iOS has two user-accessible storage locations: the Camera Roll and the Files app.
• The Camera Roll is Apple's main store for photos taken with the camera, saved from attachments, or saved from the web. Its location:
  • Filesystem/DCIM/100APPLE/ when acquired with the Apple File Conduit
  • CameraRollDomain/Media/DCIM/100APPLE when acquired by the backup process

iOS Naming ConventionsSearch on YouTubeBookmarkSaved

• Devices start with a 100APPLE folder and increment from there.
• Media items are named IMG_XXXX.HEIC/JPG/MOV.
• After 10,000 media files, numbering restarts but the files go into different folders. So a user can have two IMG_0001 images:
  • IMG_0001.HEIC in 100APPLE
  • IMG_0001.HEIC in 110APPLE
• Expect JPG, PNG or HEIC files depending on settings.
• HEIC is the standard for pictures on iOS 11 and higher.
• In AXIOM, HEIC images are viewable in Artifact Explorer because AXIOM Examine converts them to JPG.
• Screenshots saved by users are traditionally stored in the Camera Roll as PNG files. Users can also save them through the Files app.

Camera Roll FoldersSearch on YouTubeBookmarkSaved

Recently Deleted and Hidden FoldersSearch on YouTubeBookmarkSaved

• A deleted image or video is not immediately removed from the file system.
• It moves to the Photos folder "Recently Deleted".
• It stays there for 30 days.

iOS AttachmentsSearch on YouTubeBookmarkSaved

• The attachments table in sms.db tracks sent and received files. Sometimes the message is deleted but the attachment is still on the file system.
• In iTunes-style backups attachments are not stored with the messages. They are in MediaDomain, not HomeDomain.
• Full path: MediaDomain/Library/SMS/Attachments. Each file is in a folder named with a GUID, which appears in the attachment table of sms.db.

Android Media Files and LocationsSearch on YouTubeBookmarkSaved

• Camera photos and videos are usually in the DCIM directory, inside a Camera folder.
• Apps may store media in their own directory.
• Naming: 20200919_170850582.jpg = date YYYYMMDD, then time HHMMSS and milliseconds. (The slide reads this example as August 19, 2020, 5:07:50 PM UTC; the digits encode 2020-09-19, 17:08:50.582.)
• Explore motion pictures in Media in AXIOM: check the naming and metadata. In the HEX view, search for the text string ftypmp42. This marks the start of the Motion Photo's video data inside the file.

Live Data: Camera HistorySearch on YouTubeBookmarkSaved

• Shows pattern of life or usage activity. May be missing if the device was powered off before imaging.
• Shows when the device triggered a specific camera.
• Stores the package name of the app that launched the camera and when it was used.
• Connect and disconnect records show how long the camera or app was in use.
• Pulled from the adb shell dumpsys command, acquired from live devices during the Quick Image.

Example from the slide:

10-07 10:47:02  CONNECT     Camera 0  com.dropbox.android               13877
10-07 10:47:05  DISCONNECT  Camera 0  com.dropbox.android               13877
10-07 19:57:21  CONNECT     Camera 1  com.instagram.android             27166
10-07 19:57:23  DISCONNECT  Camera 1  com.instagram.android             27166
10-09 11:15:37  CONNECT     Camera 0  com.google.android.GoogleCamera   11647
10-09 11:15:59  DISCONNECT  Camera 0  com.google.android.GoogleCamera   11647
10-12 08:54:49  CONNECT     Camera 1  com.snapchat.android              22730
10-12 08:54:50  DISCONNECT  Camera 1  com.snapchat.android              22730

Web Related InformationSearch on YouTubeBookmarkSaved

• Default browsers: Safari (iOS) and Chrome (Android).
• Most mobile browser data is in an SQLite database.
• Safari has a standard mode and a private browsing mode.
• Most Safari data is in HomeDomain/Library/Safari. Some may be in the app storage folder AppDomain-com.apple.mobilesafari.

Safari History.dbSearch on YouTubeBookmarkSaved

• Safari keeps local history for 30 days in History.db in HomeDomain/Library/Safari.
• A URL not visited within the last 30 days is purged.
• History.db splits history across two tables: history_items and history_visits. Explore both in AXIOM.

Safari BrowserState.dbSearch on YouTubeBookmarkSaved

• Regardless of the 30-day window, Safari tracks all tabs currently open in BrowserState.db (tabs table).
• This includes private browsing tabs.

Chrome on AndroidSearch on YouTubeBookmarkSaved

• Browser data is often kept out of ADB backups.
• Examiners may not get web history unless a full file system is acquired.

Third-party ApplicationsSearch on YouTubeBookmarkSaved

• An iOS quick image (iTunes-style backup) or an Android Quick Image is not all the files of a third-party app. It holds only what the developers chose to back up.
• No tool will parse every app and every version. Examiners must develop a methodology to handle unknown apps.

Application Permissions (iOS)Search on YouTubeBookmarkSaved

• The APPLICATION PERMISSIONS artifact (macOS, iOS) tracks the package name, the permission requested, whether it is allowed, and how many times the app requested it.
• The "Service Name" column shows the permission.
• App settings live in the AppDomain folder, Library/Preferences directory. A plist there stores configuration and sometimes username/password data. Last login or use time may be tracked, but what is stored is up to the developer.

Android ApplicationsSearch on YouTubeBookmarkSaved

• In the apps directory of the backup, data is stored by package name (extension.company.product), as on the device.
• The amount of data is up to the developer, but the structure is the same from app to app.
• sp folder: the shared_prefs .xml files with the app's preference data.
• k folder: holds a file matching the app's bundle ID (the slide calls it a plist). It can contain user account information and SQLite databases.

KeychainSearch on YouTubeBookmarkSaved

• The password management system on iOS. Stores account passwords and tokens in a secure container.
• In a logical acquisition, keychain data is available only if the backup was encrypted.
• AXIOM splits it into two artifact categories:

Pattern-of-Life Artifacts (iOS)Search on YouTubeBookmarkSaved

Pattern of life means what the user is doing at specific times, and their behaviour patterns. It matters in many types of examination.

BiomeSearch on YouTubeBookmarkSaved

• The Biome subdirectory is in /private/var/mobile/Library and /private/var/db.
• It stores records about the specific function the user is doing.
• AXIOM parses these Biome artifacts: Application Focus, Application Install States, Application Intents, Application Launch, CarPlay Connections, Device Orientation States, Device Plugged-in States, Device Screen Backlight States, Do Not Disturb Status, Keybag Lock States, Safari History, Safari Page View, Siri Execution, Siri UI Usage, User Activity.

KnowledgeCSearch on YouTubeBookmarkSaved

• An SQLite database that tracks many activities on an iOS device.
• Records: Application Usage, Application Intents, Device Lock States, Media History, Notifications, Backlight States, Contacts, and Interactions.
• Used to find a true "pattern of life".
• Retention is only a few months. Records are purged First In, First Out.
• Explore in AXIOM (Homicide case).

PowerLogSearch on YouTubeBookmarkSaved

• Records battery usage: which apps use power and how much.
• SQLite database CurrentPowerlog.PLSQL at /private/var/mobile/Library/BatteryLife.
• Used to build pattern of life.

Location Data (iOS)Search on YouTubeBookmarkSaved

Quick self-testSearch on YouTubeBookmarkSaved