File Identification in iOS

Michael Ogata

michael.ogata@nist.gov
Questions:

• Can the NSRL method of file identification be 

used to identify files on a device running iOS?

• Once identified, can applications be 

automatically classified by their behavior?
Presentation Overview

• Applying the NSRL methodology to iOS

– Brief anatomy of iOS file system

– Brief anatomy of iOS applications

– File identification on an iPhone

• Methods for describing application 

functionality

– Manifest files

– Examining application binaries

• Benefits / Future Work
Anatomy of the iOS File System

NAND Storage

System Partition

OS Files Factory Installed 

Applications

/private/var

User Data and 

Applications
Anatomy of an iOS Application

Application Zip File 

(ipa)

iTunesArtwork iTunesMetadata.plist Payload

Application files and 

resources

Info.plist
iPhone File Identification

• Application corpus of 91 applications

– 49,403 files 

– 43,462 unique files

• File sets extracted from 1st generation iPhone

– Set 1: No applications (used as baseline)

– Set 2: One application synced to phone

– Set 3: 33 (all compatible) corpus applications 

synced to phone
Uniqueness of Files

173

477

151

446

0

100

200

300

400

500

600

iPhone No Applications ( Set 1 ) iPhone with Amazon.app ( Set 2 )

# of Files # of Unique Files
Uniqueness of Files in Set 3

20030

17095

0

2500

5000

7500

10000

12500

15000

17500

20000

iPhone with 33 Applications( set 3 )

File Unique
File Identification in Set 2

138 119

296

289

43

38

0

100

200

300

400

500

600

# Files in Set 2 # Unique Files in Set 2

Overlap with Set 1 Overlap with Amazon.app Unidentified Files
File Identification in Set 3

149 118

19799

16487

380

726

0

5000

10000

15000

20000

25000

# Files in Set 3 # Unique Files in Set 3

Overlap with Set 1 Overlap with Corpus Unidentified Files

98.8 % 96.4 %
Describing Application Functionality

• Info.plist

• Examining application binary files
Info.plist
Info.plist

• Dictionary of key-value pairs

– UIDeviceFamily / MinimumOSVersion

– UIRequiresPersistantWifi

– UIBackgroundModes

• Describes how the application functions when 

backgrounded

*http://developer.apple.com/library/ios/#documentation/General/Reference/InfoPlistKeyReference/Articles/iPhoneOSKeys.html
Info.plist Continued...

– UIRequiredDeviceCapabilities

• Specifies hardware requirements: 

– GPS and location services

– Accelerometer

– Front or rear facing cameras 

– Bluetooth

– SMS

• Requirements not declared are still permitted
Examining Application Binary Files

• String Search of binary files

• Apple Developer Libraries embedded in plain 

text

• Identified 70 unique library names
Notable Observed Libraries

Library Name # Times Observed

CoreLocation.framework/CoreLocation 69

libsqlite3.dylib 65

AddressBook.framework/AddressBook 53

CoreTelephony.framework/CoreTelephony 44

GameKit.framework/GameKit 33

Twitter.framework/Twitter 15

ExternalAccessory.framework/ExternalAcc

essory

2
Frequencies of Observed Libraries

0

10

20

30

40

50

60

70

80

90

100

/usr/lib/libSystem.B.dylib

/usr/lib/libobjc.A.dylib

/System/Library/Frameworks/UIKit.f

...

/usr/lib/libgcc_s.1.dylib

/System/Library/Frameworks/Quart

...

/System/Library/Frameworks/Audio

...

/System/Library/Frameworks/Media

...

/System/Library/Frameworks/CFNet

...

/System/Library/Frameworks/CoreL

...

/usr/lib/libstdc++.6.dylib

/System/Library/Frameworks/Open

...

/System/Library/Frameworks/Securi

...

/System/Library/Frameworks/CoreT...

/usr/lib/libxml2.2.dylib

/System/Library/Frameworks/Addre

...

/System/Library/Frameworks/Game

...

/System/Library/Frameworks/Event

...

/System/Library/Frameworks/CoreT...

/System/Library/Frameworks/Twitt

...

/usr/lib/libicucore.A.dylib

/usr/lib/libiconv.2.dylib

/System/Library/Frameworks/Assets

...

/System/Library/Frameworks/Image

...

/System/Library/Frameworks/Accel

...

/System/Library/Frameworks/Exter

...

/usr/lib/system/liblaunch.dylib

/usr/lib/system/libcopyfile.dylib

/usr/lib/system/libsystem_sandbox.

...

/usr/lib/system/libremovefile.dylib

/usr/lib/system/libxpc.dylib

/usr/lib/system/libdispatch.dylib

/usr/lib/system/libcompiler_rt.dylib

/usr/lib/system/libkeymgr.dylib

/System/Library/Frameworks/CoreI

...

/usr/lib/system/libmacho.dylib

Potential Benefits

• Augment the RDS

• Identify files on iOS devices

• Build iOS application behavior profiles

• Build iOS device capability profiles
Future Work

• Incorporate iOS application acquisition into 

NSRL acquisition chain ✓

• Build iOS Library Data Dictionary

• Build DFXML iOS data set

• Determine applicability to iPhone backup files 

– File fragments and fuzzy hashing

• Determine applicability to iCloud

• Expanding into the Android platform
Acknowledgements

• Zdziarski, J. (2003). iPhone Forensics. 

Sebastopol, CA: O’Reilly Media Inc.