Introducing cellular forensics
In the first part of this chapter, we will focus on understanding what cellular-related artifacts can be found on an iOS device and what insights we can gain by analyzing such data.
But first, what exactly is cellular data? This term refers to all those artifacts that involve telephony services and data connections, and they allow the investigator to answer questions such as the following:
- Who has the user communicated with?
- When did the device register with the cellular network?
- What websites were browsed on the device?
The first step in our analysis involves extracting some meaningful data from the com.apple.commcenter.plist
property list (PLIST), which is located at /private/var/wireless/Library/Preferences/
:
This PLIST contains several useful cellular-related values, such as its Integrated Circuit Card Identifier (ICCID), International Mobile Subscriber...