iOS Forensics Toolkit

Modular Python toolkit for parsing iOS device artifacts. Extracts data from SQLite databases and Property List files commonly found in iOS backups and file system extractions.

Supported Artifacts

Installation

git clone https://github.com/sideffectt/ios-forensics.git
cd ios-forensics
pip install -e .

Usage

Command Line

# Parse SMS database
python cli.py sms.db -o messages.json

# Parse with limit
python cli.py ChatStorage.sqlite -t whatsapp -l 100 -o output.csv -f csv

# List database tables
python cli.py sms.db --tables

# Show table schema
python cli.py sms.db --schema message

# Get call statistics
python cli.py CallHistory.storedata -t calls --stats

Python API

from src import SMSParser, WhatsAppParser, PlistParser

# Parse SMS
with SMSParser('sms.db') as parser:
    messages = parser.parse(limit=100)
    conversations = parser.conversations()
    parser.export_json('sms.json')

# Parse WhatsApp
with WhatsAppParser('ChatStorage.sqlite') as parser:
    messages = parser.parse()
    chats = parser.chats()

# Parse plist
plist = PlistParser('Info.plist')
data = plist.parse()
bundle_id = plist.get('CFBundleIdentifier')
plist.print_structure()

Timestamp Conversion

from src import cocoa_to_datetime, auto_convert

# Cocoa timestamp (since 2001-01-01)
dt = cocoa_to_datetime(700000000)

# Auto-detect format
dt = auto_convert(some_timestamp)

Project Structure

ios-forensics/
├── src/
│   ├── parsers/
│   │   ├── base.py         # Base parser class
│   │   ├── sms.py          # SMS/iMessage parser
│   │   ├── whatsapp.py     # WhatsApp parser
│   │   ├── safari.py       # Safari history parser
│   │   ├── calls.py        # Call history parser
│   │   ├── knowledgec.py   # System activity parser
│   │   ├── contacts.py     # Contacts parser
│   │   └── plist.py        # Property list parser
│   └── utils/
│       ├── timestamp.py    # Timestamp converters
│       └── export.py       # Export functions
├── cli.py                  # Command-line interface
├── setup.py
└── README.md

iOS Artifact Locations

Apple Timestamp Formats

Export Formats

• JSON (default)
• CSV
• HTML

Requirements

• Python 3.7+
• No external dependencies (standard library only)

License

MIT