shmoocon 2011 - inside the app: all your data are belong to me
TRANSCRIPT
![Page 1: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/1.jpg)
INSIDE THE APP: ALL YOUR DATA ARE BELONG TO ME Sarah Edwards [email protected], @iamevltwin Shmoocon – January 2011 © 2011 Harris Corporation
![Page 2: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/2.jpg)
About Me
¨ Digital Forensic Analyst with Harris Corporation ¨ Computer Intrusions
¤ Free time is used for iOS/Mac forensic research.
¨ Works with the Feds ¤ I don’t like wearing suits.
¨ Not a hacker. ¤ I don’t code/hack/exploit things. ¤ But I do like to get into things, I’m nosy.
© 2011 Harris Corporation
![Page 3: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/3.jpg)
Objec;ves
¨ iOS Applica;on Security Awareness ¤ Inves;gators ¤ Users ¤ Developers ¤ Bad Guys?
¨ What about Android/Blackberry/Windows?
© 2011 Harris Corporation
![Page 4: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/4.jpg)
Objec;ves
¨ If you sit through this, you’ll get: ¤ Contacts ¤ Pictures ¤ Documents ¤ Usernames ¤ Passwords ¤ Loca;onal Data ¤ …much more.
¨ It is so easy, almost too easy.
© 2011 Harris Corporation
![Page 5: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/5.jpg)
iOS Apps
¨ Prevalence ¤ iPhone ¤ iPad ¤ iPod Touch
¨ How many Apps? ¤ 10 Billion downloads ¤ ~350,000 Apps
n [hZp://www.buzzbiznews.com/035133/apple’s-‐app-‐store-‐hits-‐10-‐billion-‐downloads/]
© 2011 Harris Corporation
![Page 6: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/6.jpg)
Recent News
¨ viaForensics [viaforensics.com] ¤ appWatchDog
¨ Wall Street Journal ¤ Current privacy lawsuit ¤ Data at Rest vs. Data in Transit
¨ People vs. Diaz (California Supreme Court) ¤ Gist: Pursuant to arrest, officials can review your cellphone.
© 2011 Harris Corporation
![Page 7: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/7.jpg)
Caveats
¨ Third-party applications only. ¨ Redaction…this is a privacy talk after all. ¨ Lots of pictures ¨ Software Verification and Validation ¨ Evidence Admissibility ¨ Detailed acquisition techniques
© 2011 Harris Corporation
![Page 8: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/8.jpg)
ACCESSING THE DATA
© 2011 Harris Corporation
![Page 9: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/9.jpg)
State of Forensic Socware
© 2011 Harris Corporation
¨ There are many tools. ¨ Some are better than others. ¨ Some get only logical data. ¨ Some require the passcode. ¨ Most are expensive. ¨ Most do not auto-magically parse 3rd party
application data. ¨ Proprietary data output formats.
![Page 10: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/10.jpg)
Backups vs. Physical vs. Logical
Backups
• Easy Access • Historical
Context • Encryption • Must have HDD • Limited Data
Physical
• Difficult to capture
• Up-to-date • Access to
physical device • Potential to get
EVERYTHING • Encryption
Logical
• Easy Access • Up-to-date • Access to
physical device • Limited to
logical data
© 2011 Harris Corporation
![Page 11: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/11.jpg)
Backup Data Loca;ons
¨ Windows ¤ <APPDATA>\Apple Computer\MobileSync\Backup\
¤ \Users\user\AppData\Roaming\Apple Computer\MobileSync\Backup
¨ Mac ¤ ~/Library/Application Support/MobileSync/Backup/
© 2011 Harris Corporation
![Page 12: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/12.jpg)
Backup Files (iOS 3.x)
¨ mddata ¨ mdinfo ¨ Info.plist ¨ Manifest.plist ¨ Status.plist
© 2011 Harris Corporation
![Page 13: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/13.jpg)
Backup Files (iOS 4.x)
¨ Info.plist ¨ Manifest.mbdb ¨ Manifest.mbdx ¨ Manifest.plist ¨ Status.plist
© 2011 Harris Corporation
![Page 14: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/14.jpg)
Socware for Backups
• iPhone Backup Extractor – Mac only – Available at supercrazyawesome.com – Free! (Donations are welcome.)
© 2011 Harris Corporation
![Page 15: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/15.jpg)
Socware for Backups
¨ iPhone Backup Extractor ¤ Windows, Linux & Mac ¤ Available at:
n iphonebackupextractor.com ¤ Free & Paid Versions
© 2011 Harris Corporation
![Page 16: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/16.jpg)
Socware for Backups
¨ iBackupBot ¤ Windows Only ¤ Available at:
n icopybot.com ¤ Free Trial ($35)
© 2011 Harris Corporation
![Page 17: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/17.jpg)
Socware to Access Physical Device
¨ Forensic Socware ¨ Jailbreak
¤ SSH/DD/SCP
¨ "Zdziarski" Method ¤ NIST Approved ¤ LE/Military Only
¨ Commercial Non-‐Forensic Socware ¤ PhoneDisk ¤ PhoneView
© 2011 Harris Corporation
![Page 18: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/18.jpg)
Socware to Access Physical Device
¨ PhoneDisk ¤ Mac & Windows ¤ Available at: macroplant.com/phonedisk/ ¤ $20
© 2011 Harris Corporation
![Page 19: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/19.jpg)
Socware to Access Physical Device
¨ PhoneView ¤ Mac ¤ Available at: ecamm.com/mac/phoneview/ ¤ $20
© 2011 Harris Corporation
![Page 20: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/20.jpg)
Applica;on Directories
¨ /private/var/mobile/Application (Actual Path, linked to /User/Application)
¨ /User/Applications/########-####-####-####-############
¤ Universally Unique ID
¨ <Application_Home>/AppName.app – Applica;on Bundle (Not Backed Up)
¨ <Application_Home>/Documents/ -‐ Contains user documents and data files. (Backed Up)
¨ <Application_Home>/Library/ -‐ Contains applica;on specific files. (Backed Up)
¨ <Application_Home>/Library/Preferences – Applica;on Preference Files (Backed Up)
¨ <Application_Home>/Library/Caches – Applica;on specific support files. Persistent between applica;on launches. (Not Backed Up)
¨ <Application_Home>/tmp/ -‐ Temporary files, not persistent between applica;on launches. (Not Backed Up)
© 2011 Harris Corporation
![Page 21: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/21.jpg)
/User/Applica;ons Directory
© 2011 Harris Corporation
![Page 22: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/22.jpg)
Applica;on Directory
© 2011 Harris Corporation
![Page 23: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/23.jpg)
iTunesMetadata.plist
¨ Contains informa;on such as: ¤ Product Informa;on ¤ Purchase Data ¤ Apple Account Data
© 2011 Harris Corporation
![Page 24: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/24.jpg)
iTunesMetadata.plist
© 2011 Harris Corporation
![Page 25: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/25.jpg)
GOOD THINGS TO KNOW
© 2011 Harris Corporation
![Page 26: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/26.jpg)
Dates
¨ Many use Absolute Time ¤ Seconds from 1/1/2001 00:00:00 GMT
¨ Tools: ¤ Mac: CFAbsoluteTimeConverter
n (hsoi.com/hsoishop/socware/) ¤ Windows: Dcode
n (digital-‐detec;ve.co.uk/freetools/decode.asp)
¨ …or add 978307200 and use date -ur
© 2011 Harris Corporation
![Page 27: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/27.jpg)
Popular File Formats -‐ Plist
¨ Property List ¤ XML or Binary
¨ Tools ¤ Property List Editor
n Mac Only n Xcode n Free! (w/ Mac OS)
¤ Ibackupbot Plist Editor n Windows Only n icopybot.com/download.htm n Free!
© 2011 Harris Corporation
![Page 28: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/28.jpg)
Popular File Formats -‐ SQLite
¨ SQL-‐based rela;onal database ¨ Tools ¤ SQLite Database Browser
n Mac & Windows n sqlitebrowser.sourceforge.net n Free!
© 2011 Harris Corporation
![Page 29: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/29.jpg)
NOW TO THE GOOD STUFF…
© 2011 Harris Corporation
![Page 30: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/30.jpg)
SOCIAL NETWORKING
© 2011 Harris Corporation
![Page 31: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/31.jpg)
Facebook v.3.3.3
© 2011 Harris Corporation
![Page 32: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/32.jpg)
/Documents/friends.db
© 2011 Harris Corporation
![Page 33: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/33.jpg)
Facebook Profile
¨ hZp://www.facebook.com/profile.php?id=<UID>
© 2011 Harris Corporation
![Page 34: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/34.jpg)
User Picture (pic_square)
© 2011 Harris Corporation
![Page 35: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/35.jpg)
com.facebook.Facebook.plist
© 2011 Harris Corporation
![Page 36: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/36.jpg)
/Library/Three20
© 2011 Harris Corporation
¨ May contain: ¤ Profile Icons ¤ XML Text Files ¤ Album Photos ¤ Miscellaneous Pictures
![Page 37: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/37.jpg)
/Library/Three20
¨ <fql_result> ¨ <name>checkins_activity<name>
¤ Contains User IDs & coordinates ¤ Lots of other data
© 2011 Harris Corporation
![Page 38: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/38.jpg)
/Library/Three20
¨ <profile_response><user ¤ Contains profile data.
n User ID n Last Load Time n Birthday n Name n Hometown n Rela;onship Status n Friend Count n Email n Link to user picture n Etc.
© 2011 Harris Corporation
![Page 39: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/39.jpg)
/Library/Three20
¨ <fql_result> ¨ <name>event<name>
¤ Contains Event data
© 2011 Harris Corporation
![Page 40: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/40.jpg)
/Library/Three20
¨ <stream_post> ¤ Contains “Wall” pos;ngs for a par;cular user in <source_id>
¤ Includes n Message n Client post came from (Web, TwiZer, etc.) n User comments that include who and when. n Links to photo aZachments n Link to permalink
¨ hZp://www.facebook.com/<uid>/posts/<post_id> ¤ <post_id> is aZached to the User ID by an underscore.
© 2011 Harris Corporation
![Page 41: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/41.jpg)
/Library/Three20
¨ <photos_response> ¤ Contains links to photos, including descrip;ons, comments and user data.
¨ <profile_response><album ¤ Contains photo album informa;on.
© 2011 Harris Corporation
![Page 42: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/42.jpg)
LinkedIn v.3.5.2
© 2011 Harris Corporation
![Page 43: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/43.jpg)
com.linkedin.LinkedIn.plist
© 2011 Harris Corporation
![Page 44: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/44.jpg)
“user” Field (com.linkedin.LinkedIn.plist)
© 2011 Harris Corporation
![Page 45: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/45.jpg)
/Documents/connections_<memberid>.plist
© 2011 Harris Corporation
![Page 46: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/46.jpg)
/Documents/LinkedIn/
© 2011 Harris Corporation
![Page 47: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/47.jpg)
member_<memberid>.plist
© 2011 Harris Corporation
![Page 48: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/48.jpg)
member_<memberid>.plist
© 2011 Harris Corporation
![Page 49: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/49.jpg)
network_update_*
© 2011 Harris Corporation
![Page 50: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/50.jpg)
LinkedIn<GUID>.sqlite
¨ ZBUZZTOPICOBJECT
© 2011 Harris Corporation
![Page 51: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/51.jpg)
LinkedIn<GUID>.sqlite
¨ ZLIMESSAGE
© 2011 Harris Corporation
![Page 52: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/52.jpg)
LinkedIn<GUID>.sqlite
¨ ZLIMESSAGEMEMBER
© 2011 Harris Corporation
![Page 53: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/53.jpg)
/Library/Caches/Three20/
© 2011 Harris Corporation
![Page 54: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/54.jpg)
SHOPPING & FINANCIAL
© 2011 Harris Corporation
![Page 55: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/55.jpg)
Amazon v1.3
© 2011 Harris Corporation
![Page 56: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/56.jpg)
com.amazon.Amazon.plist
© 2011 Harris Corporation
![Page 57: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/57.jpg)
Chase v.2.8.1202
© 2011 Harris Corporation
![Page 58: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/58.jpg)
User IDs
© 2011 Harris Corporation
![Page 59: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/59.jpg)
Mint v1.7.2
© 2011 Harris Corporation
![Page 60: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/60.jpg)
/Documents/mint_gala.db
© 2011 Harris Corporation
![Page 61: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/61.jpg)
E*Trade v1.8.4
© 2011 Harris Corporation
![Page 62: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/62.jpg)
User ID
© 2011 Harris Corporation
![Page 63: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/63.jpg)
Ebay v2.0.2
© 2011 Harris Corporation
![Page 64: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/64.jpg)
com.ebay.iphone.plist
© 2011 Harris Corporation
![Page 65: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/65.jpg)
Paypal v3.1
© 2011 Harris Corporation
![Page 66: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/66.jpg)
com.yourcompany.PPClient.plist
© 2011 Harris Corporation
![Page 67: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/67.jpg)
/Documents/PayPalUserDetailsCache
© 2011 Harris Corporation
![Page 68: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/68.jpg)
v3.84 & v4.01
PageOnce – Personal Finance
© 2011 Harris Corporation
![Page 69: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/69.jpg)
Difference between v3.84 & 4.01
© 2011 Harris Corporation
![Page 70: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/70.jpg)
Difference between v3.84 & 4.01
© 2011 Harris Corporation
![Page 71: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/71.jpg)
GMAIL
© 2011 Harris Corporation
![Page 72: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/72.jpg)
iGmail v5.6.8
© 2011 Harris Corporation
![Page 73: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/73.jpg)
com.idemfactor.iGmail.plist
© 2011 Harris Corporation
![Page 74: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/74.jpg)
/Library/WebKit/Databases/https_mail.google.com_0/0000000000000001.db
© 2011 Harris Corporation
![Page 75: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/75.jpg)
MultiG v1.3
© 2011 Harris Corporation
![Page 76: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/76.jpg)
/Documents/MultiG/People.sqlite
© 2011 Harris Corporation
![Page 77: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/77.jpg)
UTILITIES
© 2011 Harris Corporation
![Page 78: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/78.jpg)
TouchTerm v2.4.2
© 2011 Harris Corporation
![Page 79: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/79.jpg)
net.jbrink.mobile.TouchTerm.plist
© 2011 Harris Corporation
![Page 80: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/80.jpg)
“connec;ons” Field
© 2011 Harris Corporation
![Page 81: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/81.jpg)
/Documents/pinchmedia/*.sql
© 2011 Harris Corporation
![Page 82: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/82.jpg)
Anonymous Web Browser v2.0
© 2011 Harris Corporation
![Page 83: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/83.jpg)
/Documents/Cookies.plist
© 2011 Harris Corporation
![Page 84: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/84.jpg)
/Library/WebKit/LocalStorage/http_www.google.com_0.localstorage
© 2011 Harris Corporation
![Page 85: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/85.jpg)
Quick Password Manager v2.2
© 2011 Harris Corporation
![Page 86: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/86.jpg)
com.yourcompany.passwd.plist
© 2011 Harris Corporation
![Page 87: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/87.jpg)
Passwords
© 2011 Harris Corporation
![Page 88: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/88.jpg)
MobileRSS HD Free v3.0
© 2011 Harris Corporation
![Page 89: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/89.jpg)
/Documents/<username>@gmail.com.sewng
© 2011 Harris Corporation
![Page 90: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/90.jpg)
/Documents/<username>@gmail.com.sqlite
© 2011 Harris Corporation
![Page 91: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/91.jpg)
com.nibirutech.MobileRSSHDFree.plist
© 2011 Harris Corporation
![Page 92: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/92.jpg)
OpenTable v3.2
© 2011 Harris Corporation
![Page 93: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/93.jpg)
com.contextop;onal.OpenTable.plist
© 2011 Harris Corporation
![Page 94: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/94.jpg)
BLOGGING
© 2011 Harris Corporation
![Page 95: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/95.jpg)
Tumblr v1.2.2
© 2011 Harris Corporation
![Page 96: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/96.jpg)
/Documents/userData.mxdata
© 2011 Harris Corporation
Unencrypted Password
![Page 97: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/97.jpg)
/Documents/textPost.details
© 2011 Harris Corporation
![Page 98: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/98.jpg)
WordPress v2.6.4
© 2011 Harris Corporation
![Page 99: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/99.jpg)
/Documents/wordpress/blogs.archive
© 2011 Harris Corporation
![Page 100: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/100.jpg)
/Documents/wordpress/<blog>.wordpress.com/<blogid>/comment.1.archive
© 2011 Harris Corporation
![Page 101: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/101.jpg)
/Documents/wordpress/<blog>.wordpress.com/<blogid>/post.1.archive
© 2011 Harris Corporation
![Page 102: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/102.jpg)
org.wordpress.plist
© 2011 Harris Corporation
![Page 103: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/103.jpg)
TRAVEL
© 2011 Harris Corporation
![Page 104: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/104.jpg)
TripIt v2.2.1
© 2011 Harris Corporation
![Page 105: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/105.jpg)
/Documents/TripIt.sqlite
© 2011 Harris Corporation
![Page 106: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/106.jpg)
/Documents/TripIt.sqlite
© 2011 Harris Corporation
![Page 107: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/107.jpg)
/Documents/TripIt.sqlite
© 2011 Harris Corporation
![Page 108: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/108.jpg)
/Documents/TripIt.sqlite
© 2011 Harris Corporation
![Page 109: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/109.jpg)
Navigon v1.7
© 2011 Harris Corporation
![Page 110: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/110.jpg)
com.navigon.NavigonNorthAmerica.plist
¨ Program Preferences ¤ Audio ¤ Terrain ¤ POIs ¤ Speed Warnings ¤ Traffic ¤ Etc.
© 2011 Harris Corporation
![Page 111: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/111.jpg)
/Library/Preferences/com.navigon.NavigonNorthAmerica.plist
© 2011 Harris Corporation
![Page 112: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/112.jpg)
/Documents/LastSearchResult.dat
© 2011 Harris Corporation
![Page 113: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/113.jpg)
/Documents/Favourite.targets
© 2011 Harris Corporation
![Page 114: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/114.jpg)
/Documents/Recent.targets
© 2011 Harris Corporation
![Page 115: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/115.jpg)
FourSquare v2.2.2
© 2011 Harris Corporation
![Page 116: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/116.jpg)
/Documents/foursquare.sqlite
© 2011 Harris Corporation
![Page 117: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/117.jpg)
/Documents/foursquare.sqlite
© 2011 Harris Corporation
![Page 118: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/118.jpg)
DOCUMENTS & FILES
© 2011 Harris Corporation
![Page 119: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/119.jpg)
Evernote v3.4.2
© 2011 Harris Corporation
![Page 120: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/120.jpg)
com.evernote.iPhone.Evernote.plist
© 2011 Harris Corporation
![Page 121: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/121.jpg)
Evernote2.sqlite.md
© 2011 Harris Corporation
![Page 122: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/122.jpg)
Library/Caches/www.evernote.com
© 2011 Harris Corporation
![Page 123: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/123.jpg)
applog.txt
© 2011 Harris Corporation
![Page 124: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/124.jpg)
Evernote2.sqlite ZENSERVICEENTITY Table
© 2011 Harris Corporation
![Page 125: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/125.jpg)
Evernote2.sqlite
© 2011 Harris Corporation
![Page 126: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/126.jpg)
Dropbox v1.3.1
© 2011 Harris Corporation
![Page 127: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/127.jpg)
/Documents/Dropbox.sqlite
© 2011 Harris Corporation
![Page 128: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/128.jpg)
com.getdropbox.Dropbox.plist
© 2011 Harris Corporation
![Page 129: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/129.jpg)
com.getdropbox.Dropbox.plist
¨ Content from “DefaultsAccountInfoKey” in bplist format, can be viewed by extracting into separate file – shown below.
© 2011 Harris Corporation
![Page 130: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/130.jpg)
/Library/Caches/FavoriteFiles.plist
© 2011 Harris Corporation
![Page 131: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/131.jpg)
/Library/Caches/cache.db
© 2011 Harris Corporation
![Page 132: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/132.jpg)
/Library/Caches/cache.db
© 2011 Harris Corporation
![Page 133: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/133.jpg)
/Library/Caches/cache.db
© 2011 Harris Corporation
![Page 134: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/134.jpg)
/Library/Caches/cache.db
© 2011 Harris Corporation
![Page 135: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/135.jpg)
Private Photo Lite v1.3
© 2011 Harris Corporation
![Page 136: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/136.jpg)
/Documents/
© 2011 Harris Corporation
![Page 137: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/137.jpg)
/Documents/photodb.sqlite
© 2011 Harris Corporation
![Page 138: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/138.jpg)
cn.mmxd.privatephotoslite.plist
© 2011 Harris Corporation
![Page 139: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/139.jpg)
© 2011 Harris Corporation
![Page 140: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/140.jpg)
Echofon v3.1.8
© 2011 Harris Corporation
![Page 141: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/141.jpg)
/Preferences/net.naan.TwiZerFon.plist
© 2011 Harris Corporation
![Page 142: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/142.jpg)
db3.1.5.db
¨ “users” Table ¤ Contains user details:
n TwiZer User ID n Name & Screen Name n User entered loca;on, descrip;on and website. n Count of followers/friends/favorites/tweets n Is the account protected or verified? n Link to profile icon (hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg)
© 2011 Harris Corporation
![Page 143: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/143.jpg)
/Library/profile_images ¨ hZp://a2.twimg.com/profile_images/647123757/Muppet-‐Beaker_normal.jpg
© 2011 Harris Corporation
![Page 144: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/144.jpg)
db3.1.5.db
¨ hZp://twiZer.com/statuses/user_;meline/105533433.rss
© 2011 Harris Corporation
![Page 145: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/145.jpg)
db3.1.5.db
© 2011 Harris Corporation
![Page 146: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/146.jpg)
db3.1.5.db
¨ “direct_messages” Table ¤ Contains direct messages.
n To & From (TwiZer IDs and Screen Names)
n Dates
© 2011 Harris Corporation
![Page 147: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/147.jpg)
Library/Cookies/Cookies.plist
© 2011 Harris Corporation
![Page 148: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/148.jpg)
HootSuite v2.0.2
© 2011 Harris Corporation
![Page 149: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/149.jpg)
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
![Page 150: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/150.jpg)
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
![Page 151: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/151.jpg)
com.hootsuite.hootsuitelite.plist
© 2011 Harris Corporation
![Page 152: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/152.jpg)
Twitteriffic v3.0.2
© 2011 Harris Corporation
![Page 153: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/153.jpg)
/Documents/accounts.plist
© 2011 Harris Corporation
![Page 154: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/154.jpg)
Timeline
© 2011 Harris Corporation
![Page 155: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/155.jpg)
/Documents/searches.plist
© 2011 Harris Corporation
![Page 156: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/156.jpg)
Search Databases
© 2011 Harris Corporation
![Page 157: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/157.jpg)
Tweetdeck v1.4.1
© 2011 Harris Corporation
![Page 158: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/158.jpg)
/Documents/tddb.0.2.sqlite3
© 2011 Harris Corporation
![Page 159: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/159.jpg)
/Documents/column_cache_1
© 2011 Harris Corporation
![Page 160: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/160.jpg)
/Documents/tddb.0.2.sqlite3
© 2011 Harris Corporation
![Page 161: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/161.jpg)
COMMUNICATION
© 2011 Harris Corporation
![Page 162: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/162.jpg)
Skype v3.0
© 2011 Harris Corporation
![Page 163: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/163.jpg)
/Library/Preferences/com.skype.skype.plist
© 2011 Harris Corporation
![Page 164: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/164.jpg)
Skype Logs
© 2011 Harris Corporation
![Page 165: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/165.jpg)
Skype Logs
© 2011 Harris Corporation
![Page 166: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/166.jpg)
Skype Logs
© 2011 Harris Corporation
![Page 167: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/167.jpg)
Skype Logs
© 2011 Harris Corporation
![Page 168: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/168.jpg)
Skype Logs (Windows)
¨ Skype Parsing Software ¤ SkypeLogView ¤ Nirsoft
n Available at: nirsoft.net/utils/skype_log_view.html n Free!
¤ Skype Parser n Redwolf Computer Forensics n Available at: redwolfcomputerforensics.com/downloads/
skype-log-installer-1.7.exe
© 2011 Harris Corporation
![Page 169: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/169.jpg)
AIM (Free) v4.5.2
© 2011 Harris Corporation
![Page 170: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/170.jpg)
com.aol.aim.plist
© 2011 Harris Corporation
![Page 171: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/171.jpg)
/Documents/userAccounts/<GUID>.account
© 2011 Harris Corporation
![Page 172: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/172.jpg)
/Documents/userAccounts/<GUID>.buddylist
© 2011 Harris Corporation
![Page 173: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/173.jpg)
/Documents/userAccounts/<GUID>.history
© 2011 Harris Corporation
![Page 174: Shmoocon 2011 - Inside the App: All Your Data are Belong to Me](https://reader034.vdocument.in/reader034/viewer/2022042714/5511ba1e4a7959ca028b4727/html5/thumbnails/174.jpg)
WRAPPING UP
© 2011 Harris Corporation