Analyzing networking data
Modern smartphones rely more than ever on a networking connection to perform their tasks and enrich the user's experience. At the beginning of this chapter, we discussed cellular-related artifacts; now, we will focus on Wi-Fi connections before discussing network usage in general.
Analyzing the networking data that's provided by an iOS device can give the investigator a precise idea of what services and applications are consuming bandwidth, and which networks the device is connected to.
We'll introduce the topic by learning how to extract some basic networking-related data from a full filesystem.
Airplane mode
To detect if the device was placed in airplane mode or not, you can examine the com.apple.radios.plist
file, which is located at /private/var/preferences/SystemConfiguration/
. The PLIST contains an AirplaneMode
key with a value of true
or false
.
Wi-Fi MAC address
The MAC address of the wireless network interface within...