Raw disk images or the backup that you extracted in Chapter 3, Data Acquisition from iOS Devices, and Chapter 4, Data Acquisition from iOS Backups, should contain the following plist files that are important for an investigation. The files displayed are extracted from an iOS 13.2 device backup. The file locations may vary for your iOS version.
The following are the plist files that contain data that may be relevant to your investigation:
| plist file |
Description |
| /HomeDomain/Library/Preferences/com.apple.commcenter.shared.plist |
Contains the phone number in use |
| /HomeDomain/Library/Preferences/com.apple.identityservices.idstatuscache.plist | Contains information about the email address used for the Apple ID and the phone numbers of the individuals the user interacted with via FaceTime or iMessage using this ID |
| /HomeDomain/Library/Preferences/com.apple.mobile.ldbackup.plist | Contains the timestamps of the last iTunes and iCloud backups, the last iTunes backup time zone, and if it was encrypted or not |
| /HomeDomain/Library/Preferences/com.apple.MobileBackup.DemotedApps.plist | Contains the list of unused applications that were automatically offloaded by the operating system |
| /HomeDomain/Library/Preferences/com.apple.mobilephone.speeddial.plist | Contains the list of the user's favorite contacts, including their names and phone numbers |
| /HomeDomain/Library/Preferences/com.apple.preferences.datetime.plist | Contains information about the time zone set by the user |
| /RootDomain/Library/Caches/locationd/clients.plist | Contains the list of applications that use location Services |
| /RootDomain/Library/Preferences/com.apple.MobileBackup.plist | Contains information about the last restoration from the backup, including the restore start date, file transfer duration, number of files transferred, source device Unique Device Identifier (UDID), and so on |
| /SystemPreferencesDomain/SystemConfiguration/com.apple.mobilegestalt.plist | Contains the device name assigned by the user |
| /SystemPreferencesDomain/SystemConfiguration/com.apple.wifi.plist | Contains information about wireless access points used by the device owner |
| /WirelessDomain/Library/Preferences/com.apple.commcenter.plist | Contains information about the device phone number, network carrier, ICCIDs, and international mobile subscriber identities (IMSIs) |
Of course, plist files don't contain as much information as SQLite databases, but they can still be useful during your forensic examinations. Next, we'll look at some other files that may be also useful.