## 4 Analysis and Findings
### iPhone Analysis
#### 4.1.1 Metamask  
All Metamask-related files were located in the package \private\var\mobile\Containers\Data\Application\81498 DCE-4B2A-4322-B54B-F24 EF002089F, unless otherwise noted. We were able to recover the addresses of the two created wallet addresses from multiple locations and, most importantly, within the \Library\ApplicationSupport\355 io.metamask.MetaMask\RCTAsyncLocalStorage_V1\manifest.json file. The deviceUID identifier was also recovered from the \Library\Preferences\io.metamask.MetaMask.357 plist file. In general, the app's properties and preferences are stored in these properties list (plist) files.  
Additionally, we were able to recover a database with a table named OperatingDates, which shows the operating dates of the app. For the first forensic image we took, this table had only two entries, which are the dates of the first population (see Figure 9). The table OperatingDates is located within the \Library\WebKitWebsiteData\Resource\LoadStatistics\observations.db database.  
Due to the fact that the app mainly uses https requests to receive data, most of the responses and received data cached were recovered in a database. The database called Cache.db is located in the \Library\Cachesio.metamask.MetaMask folder. It contains two very important tables named cfurl_cache_response and cfurl_cache_receiver_data. Figure 10 shows the contents of table cfurl_cache_response with its columns.  
Figure 8: The identifier called DeviceUID for both apps within session_bundles.log file.  
Figure 9: Recovered operating dates of the app within the observations.db database.  
In addition, NFTs are purchased through NFT marketplaces such as Opensea, Rarible, and AirNFT. In our research, we used AirNFT (Available online: [[https://www.airnfts.com](https://www.airnfts.com)]([https://www.airnfts.com](https://www.airnfts.com)) (accessed on 25 May 2022) in the scenarios. As a result, we were able to recover two account addresses that were used for the Airnft service and accepted the use terms stored in a table named ItemTable within the file \Library\WebKitWebsiteData\LocalStorage\https\app.airnfts.com_0.localstorage (see Figure 11). This shows how important it is to investigate the local storage files that are kept for each service that the user uses in the app.  
In the scenario, we purchased an NFT numbered _059_ within the collection of _Chonky Cats_. We were able to find information (e.g., name, description, external_url, price, id, baseID, creatorAddress, and ownerAdress) about the NFT inside a file named \(5A46E59D\)-\(987E\)-\(425B\)-\(8A98\)-\(B401493E924E\) within the \Library\Caches\io.metamask. MetaMask\fsCachedData\ path (see Figure 12 for all recovered information). Furthermore, this file contains other valuable information about the NFT attributes, a complete history of previous owners, the listing price, and its creator. For example, the country in which the account of the creator of NFT created the account was discovered within the file.  
Furthermore, more information was recovered from the _com.apple.WebKit.Networking_ layer within the app. The file named HSTS.plist within \Library\Caches\com.apple.WebKit.Networking\ contains HTTP Strict TransportSecurity (HSTS), which is used mainly to aid in the prevention of attacks on websites, such as those using secure socket layer (SSL) stripping and man-in-the-middle tactic, by using a policy technique. (see Figure 13). This file can help determine the network services that were used by the user that created the storage sessions.  
Figure 10: Recovered content from the \(\text{clurl}\_cache\_response\) table.  
Due to the use of the Pancakeswap service, which is used as a native decentralized exchange to the BNB chain, we were able to recover the account information for Pan-cakeswap within a file named https_pancakeswap.finance_0.localstorage within the...\Library\WebKit\WebsiteData\LocalStorage path.