Introducing Apollo

So far, we have learned how to manually analyze pattern-of-life data by querying the SQLite databases. However, there is another option that automates the process and allows the investigator to look at all the data in a unified database.

Apollo, which stands for Apple Pattern of Life Lazy Output'er, is a Python script developed by Sarah Edwards (@iamevltwin) that correlates multiple sources of data into a unified timeline, simplifying the examiner's job of finding out what exactly was happening on the device.

The tool consists of dozens of highly configurable modules that each query a specific iOS database to extract data and events. The main Python script then compiles the results of each module into a unified CSV file or SQLite database.

We'll now go over the steps required to download the tool, run it, and export the results into a single SQLite database:

1. To download Apollo, head over to its GitHub repository located at https:/...