The data can also be seen in the preview pane in binary mode without the need to export the blob content. The exported data is a bplist that maps all pertinent UUID numbers to the application name and/or bundle id. Export the blob in the value field for the id. Use the 101 id and look for it in the 'kvs' table in the 'application_identifier' field. Take note of the corresponding id number. Look for the bundle id name in the 'application_identifier_tab' table. Open the SQLite database with a SQLite browser. This SQLite database provided the connection between the bundle id and the UUID numbers in the 'Application' directory. The bundle id keyword search in Autopsy led me to the 'applicationState.db' file located at Contains items like 'LAST_VIEWED_PATH', 'first_run_date_key', and 'Emoji UsageHistory.'./private/var/mobile/Containers/Data/Application/*UUID*/Documents/RCTAsyncLocalStorage_V1/manifest.json.The more direct way to determine the correct application folder where the data resides is to open each one by one and look for the bundle id in the path or by using commercial tools.Open blob to map UUID to application name. Use id to extract blob field in the 'kvs' table. Look for app name in 'application_identifier_tab' table.Contains a bplist that establishes the relationship between the bundle id (), app id (Discord.app) and the UUID folder name in the Applications folder./private/var/mobile/Library/FrontBoard/applicationState.db.Chat and media files found in the fsCachedData directory.The UUID formatted directory name in the path maps to the bundle id of the app./private/var/mobile/Containers/Data/Application/* UUID*/Library/Caches//fsCachedData/.Discord for iOS keeps chat data in the following directories and files:
0 Comments
Leave a Reply. |