Artifact suggestions

[Jadoo4QFan]

System artifacts found during exploration of personal backups. These are suggestions, so you don't need to implement all of them.

• /private/var/mobile/Library/SMS/Drafts/*/composition.plist - iMessage's storage of text messages that were typed, but not (yet/ever) sent. Populated on most real-world devices. Very significant.

• /private/var/mobile/Media/PhotoData/Caches/search/RecentSearches.plist - A XML PList that stores recent searches made in the Photos application.

• /private/var/mobile/Preferences/com.apple.Music.plist - Music app search history

• /private/var/mobile/Library/Preferences/com.apple.mediaremote.plist - Stores recently connected to speakers and their timestamps, among others

• /private/var/mobile/Library/Preferences/com.apple.mediaexpirience.plist - Stores all volume levels and category (Headphones/unspecified) for all speakers ever connected.

• /private/var/mobile/Library/Preferences/com.apple.EmojiPreferences.plist - Stores recently used emojis, emoji selected skin tones, and possible recent keyboard-suggested emojis

• /private/var/mobile/Library/Preferences/ - UserDefaults style artifact for timelineing, and userDefaults also lacks support for backups, only full filesystems.

• com.apple.siri.parsec.HashtagImagesApp.HashtagImagesExtension.plist - This jargon of a filename stores recent searches, recently selected GIFs, and reported GIFs (as well as a tiny legal notice counter) linked to the "#images" applet in iMessage.

• TikTok: /Documents/tako/(ACCOUNT ID)/db - Stores the message history of TikTok's new-ish Tako AI chatbot

• TikTok: /Documents/WatchHistory/*_history_WCDB.sqlite - Stores watch history in some TikTok clients, and others empty.

Apple Watch Backups/Sync Data (/private/var/mobile/Library/DeviceRegistry/[GUID]/)

Apple Watch sync data and backups are stored here. When a new watch is purchased or a watch is unpaired, the data is retained, leaving a few good artifacts that persist post-deletion, although it's not as good as most think it contains, and additionally, it is unsupported on all commercial tooling. Again, you do not have to complete all of them, but these are suggestions for potential future artifacts after digging in personal backups and previous research

• /NanoPreferencesSync/Backup/Files - Watch Faces (zip packages)

• /NanoPreferencesSync/NanoDomains/ - All bplists that contain per-app settings. Can be parsed similar to the userDefaults artifact. However, specific ones warrenting their own artifact include com.apple.Carousel , which stores the home screen layout, and com.apple.mobilephone contains fragments of voicemail records

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.Carousel - Stores a simple listing of most recently opened applications from the app switcher.

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.ControlCenter - Control center. Controls are mapped as a number, so reverse enginnering is needed.

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.mediaexperience - Stores the volume levels and names of each speaker, as well as coincidentally the Bluetooth devices paired.

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.mobiletimerd - Stores a backup of all timers, alarms, and sleep alarms. Identical to the Preferences equivelent.

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.NanoRemoteMediaServersUI - Possibly the most interesting one I found. Stores a large list of every Apple TV the Watch has ever seen in the Remote app, including names, and two timestamps. Pretty useful as it tracks large location histories, such as people's home with Apple TVs, workplaces, schools driven by, etc.

• /NanoPreferencesSync/Backup/Files/UserDefaults/com.apple.private.NanoTimer - Stores an MRU of recent custom timers in seconds.

• More research against /EventKitSync and the other files of /AddressBook

• /NanoPreferencesSync/Caches/ - BPlists that show sync timestamps per each settings backup key above.

• /NanoPhotos/collectionTargetMap - Similar to the registry.sqlite for Mail, but stores the specific photos that were synced onto the watchOS Photos app.

• /BulletinDistributer - Contains notification sync cache, including old notifications.

• /NanoPasses/nanopasses.sqlite3 - Stores a copy of the Passbook's passes

• /NanoMail/registry.sqlite - Contains mail fragments, account information, etc. More research needed.

• /NanoMaps/Pins.mapdata - Stores Apple Maps pins on the Apple Watch

• /AddressBook/favorites.previous The second retired artifact which copies the Phone's favorite contacts.

• /NanoMaps/GeoHistory.mapsdata - A copy of the iOS Maps database, should be a second path to the current mapsdata artifacts. This artifact has been retired from newer watch version

• /private/var/mobile/Library/Preferences/com.apple.nanoweatherprefs.plist - Stores Apple Watch specific weather cities and coordinates, outside of the Backup folder.

• /private/var/mobile/Library/Preferences/com.apple.Tincan.plist - Apple Watch Walkie-Talkie whitelist contacts

[stark4n6]

@Jadoo4QFan we already support the draft iMessages, if you can maybe provide some test data for any others we can attempt to get parsers made.

[Jadoo4QFan]

Don't know why I did not see draftMessages.py , the column was already there and populated. Nonetheless, RecentSearches.plist can be extracted via AFC on any device, including your own personal devices, it is in PhotoData/Caches/search .

Many are either in personal iTunes-style backups, such as most preferences, and the Apple Watch backups who only obviously work on Apple Watch owners. Anyone with a jailbroken device can try generating personal test data possible.

Certain artifacts like emojis and TikTok watch history are likely on the test images.

Unfortunately, for obvious security, privacy, and confidentiality reasons, I cannot provide you with test data.