Leveraging iOS Databases In Your Investigation with Physical Analyzer
Seasoned digital investigators know that iOS databases potentially contain a wealth of valuable information that can help move investigations forward. The following are some examples of valuable digital intelligence that can be extracted.
Types of iOS databases you can leverage in your investigation
When extracting a full file system from an iOS device, valuable databases such as ScreenTime, KnowledgeC, and Apple Health can be extracted.
ScreenTime keeps track of all application usage on iOS Devices. Apple Health can show you Heart rate and Steps & Distance. Together with KnowledgeC, these iOS databases can become a digital intelligence goldmine as they open a window into a phone owner’s actual usage.
These are only some examples of what Cellebrite Physical Analyzer can decode from these databases. As you may suspect, these databases contain a lot more data, which can be overwhelming and exhausting if you’re trying to review all the artifacts.
Cellebrite’s unique approach to iOS databases
Cellebrite Physical Analyzer is the only tool that aggregates the decoded artifacts, runs an advanced de-duplication mechanism, and simplifies the results. Our approach focuses on getting insights from the evidence quickly to minimize the time you may be spending on less relevant data.