search

log2timeline / plaso

Super timeline all the things
https://plaso.readthedocs.io
Apache License 2.0
1.73k stars 349 forks source link

Add iOS specific parsers : DataUsage.sqlite & com.apple.identityservices.idstatuscache.plist #3806

Open rgayon opened 3 years ago

rgayon commented 3 years ago

Context: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/#_ftn1

iOS maintains records of process executions and their respective network usage in two SQLite database files called “DataUsage.sqlite” and “netusage.sqlite” which are stored on the device.

record of Apple IDs seen by each installed application in a plist file located at /private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist

We already have parsers for these file formats so I suppose what we need is some test data to figure out the schema

rick-slin commented 1 year ago

I'd like to work on this issue. I was thinking of making two PRs, one per file.