Other important files
Apart from SQLite and plist files, several other locations may contain valuable information to an investigation.
The others sources include the following:
Cookies
Keyboard cache
Photos
Wallpaper
Snapshots
Recordings
Third-party applications
Cookies
Cookies can be recovered fromĀ /private/var/mobile/Library/Cookies/Cookies.binarycookies
. This file is a standard binary file containing cookies that are saved when web pages are accessed on the device. This information can be a good indication of what websites the user has been actively visiting. Keep in mind that third-party applications may also contain this file.
To convert the binary cookie to human readable format, run the BinaryCookieReader.py
Python script on the cookie file, as in the following command (the Python script source code is available in the code bundle of the book):
$python BinaryCookieReader.py Cookies.binarycookies Cookie : __utma=167051323.813879307.1359034257.1367989551.1386632713.9; domain=.testflightapp.com...