## 4 Analysis and Findings
### iPhone Analysis
#### 4.1.2 Trust Wallet  
All Trust Wallet-related files were located in package \private\var\mobile\Containers\DataApplication\65 BFA36C-A34F-4791-8 BA9-E7 AE9561A454, unless otherwise noted. The Trust Wallet app creates a database called _Cache.db_ that stores a lot of information, and this database is sorted into the \Library\Caches\com.sixdays.trust folder. For example, tables named cfurl_cache_response and cfurl_cache_response store information-related responses to CFURL, where CFURL, according to the Apple Developer website [67], helps programs and apps that rely on URLs to access resources, such as local files. These tables were very useful for recovering the device ID that is needed to access the device wallets. Furthermore, within the table cfurl_cache_response we were able to recover the device ID used to create the wallets (see Figure 14). In addition, realm databases, a lightweight object-oriented cross-platform database developed by MongoDB [68] as an alternative to SQLite, were present in the app for wallets; however, they were all encrypted. They are stored in the Documents\realm folder. In Section 4.2.2, we explain more about these databases since the realm databases for wallets on Android were not encrypted. The folder Library\Caches contains many more crucial folders that contain important data for investigators. Furthermore, the folder named com.onevcat.Kingfisher.ImageCache.default contains all the cached images. The folder named com.apple.WebKit.Networking contains information about HSTS along with the creation time and the expiration time (see Figure 15 for an example of the HSTS.plist file). Moreover, the folder named WebKitNetwork\CacheVersion\16 Blobs, which is still in the folder Caches, contains blobs of all NFT images that were seen or cached by the phone. After recovering the device ID used to create wallets and recover cached files, it is necessary to recover the transactions that occurred on the phone. The \Library\Preferences\com.sixdays.trust.plist file luckily contains preferences and information of the wallets that the user initiated using the device (see Figure 16). It is important to note that this plist file keeps a record of actions that were performed using the device; therefore, if the user was using another device, the information could be missing. Each recovered action is time-stamped using the UTC time. Figure 14: Trust Wallet device ID within one of the HTTPS requests. * [0]**HSTS Store Schema Version = 3**
* [1]**HSTS Content Version = 0**
* [2]**HSTS Preload Entries Signature = 0**
* [3]**com.apple.CFNetwork.defaultStorageSession**
* [0]**ducduckogo.com**
* [0]**HSTS Host = True
* [1]**Expiry = 706662753.483783
* [2]**Create Time = 675126753.483785
* [1]**pancakeswap.finance**
* [0]**HSTS Host = True
* [1]**Expiry = 738198737.398511
* [2]**Create Time = 675126737.398513
* [2]**uniswap.org**
* [0]**Include Subdomains = True**
* [1]**Create Time = 675121916.722535
* [2]**Expiry = 690673916.722533
* [3]**HSTS Host = True**As highlighted in the scenarios covered in Figure 6, several services were used within the app. The file Cookies.binarycookies contains cookies and timestamps for the services visited, and this file is stored in the folder LibraryCookies. Figure 17 illustrates an example of a user-visit service (i.e., OpenSea.io) along with the session ID. In the scenario, the AirNFT service was used to buy the NFT. Due to the fact that AirNFT is an online website service within the app, its data were recovered from the LibraryWebKitWebsiteData folder. This folder contains a subfolder named LocalStorage, which stores local information about user web sessions. The file https.app.airnfts.com_0.localstorage stores the AirNFT user ID (0 xE689E84497c4560596a5 f888a053093 DchAEB41D), which confirms that it was used and that the user has logged into the service. This information can allow the investigator to link other online services, such as AirNFT accounts, with the device user.