startbootstrap icon indicating copy to clipboard operation
startbootstrap copied to clipboard

Add iOS specific parsers : DataUsage.sqlite & com.apple.identityservices.idstatuscache.plist

Open rgayon opened this issue 2 years ago • 1 comments

Context: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/#_ftn1

iOS maintains records of process executions and their respective network usage in two SQLite database files called “DataUsage.sqlite” and “netusage.sqlite” which are stored on the device.

record of Apple IDs seen by each installed application in a plist file located at /private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist

We already have parsers for these file formats so I suppose what we need is some test data to figure out the schema

rgayon avatar Jul 21 '21 13:07 rgayon

I'd like to work on this issue. I was thinking of making two PRs, one per file.

rick-slin avatar May 31 '23 11:05 rick-slin