MOBILE FORENSICS

Conduct a forensic analysis of installed apps

Installed applications are among the most important sources of data in an iPhone investigation. Messaging apps, email programmes, browsers, banking apps and social media platforms store a wealth of information which – depending on the data available – can be analysed forensically.

SQLite databases
Property Lists (Plists)
Cache files
Configuration files
Log files
App permissions
Media and document files
Metadata and timestamps

TECHNICAL BACKGROUND

Technical Fundamentals

Every iOS app essentially runs in its own sandbox. This is where user data, configuration files and application data, amongst other things, are stored.

Examples of forensically relevant artefacts include:

  • •SQLite databases
  • •Property Lists (Plists)
  • •Cache files
  • •Configuration files
  • •Log files
  • •App permissions
  • •Media and document files
  • •Metadata and timestamps

The data available depends on the app in question, the version of iOS and the backup method.

OUR APPROACH

This is how your examination will be carried out

A transparent process – from the initial enquiry to the handover of the report.

1
Following the forensic data backup, the relevant app artefacts are analysed in a structured manner. In addition to using recognised analysis tools, a manual examination of the databases, Plists and other files is carried out. The results are documented in a reproducible manner and evaluated within the overall technical context.
2
LanCologne produces expert reports for private individuals, as well as for companies and solicitors. Our reports have already been used in court proceedings. In some cases, we have been directly commissioned to produce IT forensic reports. Upon request, we can provide anonymised or redacted sample reports or extracts.

TYPICAL QUESTIONS

When is this analysis required?

  • ✔Which apps are installed?
  • ✔What data does an app store?
  • ✔Which timestamps can be analysed?
  • ✔What permissions have been granted?
  • ✔Can deleted artefacts be reconstructed?

LIMITATIONS & CONCLUSION

What you should know

Not every application stores the same information. Furthermore, encryption, deletion processes, app-specific settings or changes to the iOS version may affect the scope of the available artefacts. These limitations are clearly set out in the report.

Analysing installed apps often provides key insights into usage, communication and stored information. Such analysis is always carried out taking into account the technical context and the specific research question.

CUSTOMER REVIEWS

What our customers say

4.8 out of 5 stars on Trustpilot · 54 reviews

★★★★★

“The highest standards of professionalism, prompt service and excellent communication. They made the seemingly impossible a reality. This is what genuine customer service is all about – unrivalled in Germany!”

idalein

Verified review on Trustpilot

★★★★★

“Very helpful advice, excellent responsiveness and communication. My problem was completely resolved and the lost data was recovered. I’m very satisfied and, of course, relieved!”

Layla Pankratz

Verified review on Trustpilot

★★★★★

“My problem was sorted out professionally and quickly; everyone I spoke to was always friendly, and I can still get in touch if I have any questions – I’m very grateful for that!”

a woman from Cologne

Verified review on Trustpilot

Enquire now – free initial consultation

Would you like to have the data from installed iPhone apps professionally analysed? LanCologne can assist you with an objective IT forensic analysis and comprehensive expert documentation.

RELATED TOPICS

You might also be interested in

FREQUENTLY ASKED QUESTIONS

Frequently Asked Questions

Click on a question to see the answer.

Are all apps assessed in the same way?
No. The structure and storage locations vary depending on the application.
Why are SQLite databases important?
Many iOS apps store their data in SQLite databases.
What is the significance of plists?
They often contain configuration and settings information.
Can deleted app data be recovered?
That depends on the data backup and the artefacts available.
Can an expert report be drawn up?
Yes, provided that this forms part of the terms of reference for the investigation.