Other important files
Apart from SQLite and plist files, several other locations may contain valuable information to an investigation.
The others sources include the following:
Cookies
Keyboard cache
Photos
Wallpaper
Snapshots
Recordings
Downloaded applications
Cookies
Cookies can be recovered from /private/var/mobile/Library/Cookies/Cookies.binarycookies
. This file is a standard binary file that contains cookies saved when web pages are accessed on the device. This information can be a good indication of what websites the user has been actively visiting.
To convert the binary cookie to human readable format, run the BinaryCookieReader.py
Python script on the cookie file, as shown in the following command. The Python script source code is available in the code bundle of the book.
$python BinaryCookieReader.py Cookies.binarycookies Cookie : __utma=167051323.813879307.1359034257.1367989551.1386632713.9; domain=.testflightapp.com; path=/; expires=Wed, 09 Dec 2015; Cookie : __utmb=167051323.24.8.1386633092975...