I have an Advanced Logical Extraction, Method 1 of an iPhone X. I am attempting to determine what activity was happening at a given span of time. I have found two matches for the time frame given. I do not know how to interpret the what activity is going on by the 'ZPROCNAME' column. I found this in /var/wireless/Library/Databases/DataUsage.sqlite>ZPROCESS It shows accountsd/com.apple.datausage.itunesaccount and dataaccessd/com.apple.datausage.docsandsync. What does this mean?
And I also found two corresponding time frame hits in /var/wireless/Library/Databases/DataUsage.sqlite>ZLIVEUSAGE but here i am attempting to determine what ZWWANIN and ZWWANOUT. I feel like these are related and it is showing how much data was transfered. Would this be cellular data not wifi? Also, is it meaning in bytes or kilobytes, or megabyte?
It cut off
Thank You,
ForensicChicken
Also, is it meaning in bytes or kilobytes, or megabyte?
It's in bytes.
Here's a good resource for some more explanation; https://
Thank you, This article is helpful.
ForensicChicken