APPENDIX

Tools to analyze common

file and data types
B
There are several file types and pieces of data that cannot be viewed using standard
applications. The following lists out many of the common file and data types
recovered from an iPhone as well as what applications can be used to view these files:
• Property Lists (plists): Any text editor can be used to view a plist. Plutil can be
used to convert from binary to XML (http://scw.us/iPhone/plutil/)
• SQLite database: SQLite Database Browser (http://sqlitebrowser.sourceforge
.net/)
• Unix Epoch Timestamps: Epoch Converter Website (http://www.epochconverter
.com/)
• Mac OS X Epoch Timestamps: CFAbsoluteTimeConverter (http://www.macup
date.com/app/mac/37446/cfabsolutetimeconverter)
• Disk Image File (.dmg): Can be mounted on a Mac using DiskImageMounter
(double-clicking on this file will mount with this utility by default). Other
forensic imaging tools that support the HFSX file system can also be used to
mount an iPhone.dmg file, as well as mounting via command line (see
Chapter 6 for details).

iPhone and iOS Forensics

© 2011 Elsevier Inc. All rights reserved.
293