Summary

In this chapter, we learned which are the most common types of artifacts found on an iOS device and how to analyze these files.

First, we introduced databases and learned how SQLite organizes data into tables, columns, and rows. Then, we took a deep dive into SQLite's internal architecture to understand how records are organized at a lower level and where deleted records can be found. We discussed possible options to attempt the recovery of deleted data, such as manually analyzing the database through a hex viewer or using tools such as FQLite.

Further on in the chapter, we talked about property lists and protocol buffers, which can also be found on iOS devices in XML or binary format. To be readable, these files first need to be decoded.

Finally, in the last part of the chapter, we outlined some common locations where artifacts can be found and listed some essential files that should be considered in every investigation. In the next chapter, we will discuss...