iPhone X DataUsage....
 
Notifications
Clear all

iPhone X DataUsage.sqlite

3 Posts
2 Users
0 Likes
3,760 Views
(@forensicchicken)
Posts: 7
Active Member
Topic starter
 

I have an Advanced Logical Extraction, Method 1 of an iPhone X. I am attempting to determine what activity was happening at a given span of time. I have found two matches for the time frame given. I do not know how to interpret the what activity is going on by the 'ZPROCNAME' column. I found this in /var/wireless/Library/Databases/DataUsage.sqlite>ZPROCESS It shows accountsd/com.apple.datausage.itunesaccount and dataaccessd/com.apple.datausage.docsandsync. What does this mean?

And I also found two corresponding time frame hits in /var/wireless/Library/Databases/DataUsage.sqlite>ZLIVEUSAGE but here i am attempting to determine what ZWWANIN and ZWWANOUT. I feel like these are related and it is showing how much data was transfered. Would this be cellular data not wifi? Also, is it meaning in bytes or kilobytes, or megabyte?

It cut off

Thank You,

ForensicChicken

 
Posted : 21/10/2019 10:55 pm
(@deefir)
Posts: 49
Eminent Member
 

Also, is it meaning in bytes or kilobytes, or megabyte?

It's in bytes.

Here's a good resource for some more explanation; https://www.mac4n6.com/blog/2019/1/6/network-and-application-usage-using-netusagesqlite-amp-datausagesqlite-ios-databases

 
Posted : 22/10/2019 1:49 am
(@forensicchicken)
Posts: 7
Active Member
Topic starter
 

Thank you, This article is helpful.

ForensicChicken

 
Posted : 23/10/2019 12:53 pm
Share: