![]() In Messages there are two types of location sharing: Send My Current Location (MCL) and Share My Location (SML). So, this post will focus on the various situations in which a user could send or receive location data. There are differences between non-continuous, one-time location sharing and continuous, real-time location sharing, and the venue in which location is shared. One thing I learned from testing is that not all location sharing in Messages looks the same in sms.db. And finally, I thought it would be great to take a look at location sharing, in general, in in iMessages, so this article will encompass both types of location sharing.Īs a side note, I discovered a hint about these messages in my Twitter history….back in July…from Sarah Edwards. First, to test this I used four phones: an iPhone 12 Pro and iPhone XS both running iOS 14.8, a first generation iPhone SE running iOS 14.3, and an iPhone 8 running iOS 15. What was unusual was that the entries had item_type column values of four (4), something the examiner nor I recalled seeing before.Ī quick check of my public iOS images found that these values existed in the iOS 13 images and when I checked the documentation I found the values were related to location sharing in the Messages app.Ī few notes. If you have done iOS forensics before, you know this is not unusual. Another examiner was seeing entries in the messages table that had timestamps, but no text associated with the entries. The question involved the iOS Messages database, sms.db. Like more recent posts, this one is shorter than usual. It also helps when it comes to generating public images as I know I can include that particular thing in a future image. ![]() It gives me an opportunity to really deep-dive into something, generate test data, test theories, generate more test data, test more theories, and share what I find. So, as is the case many times when I do not the answer to something, I set out to test it and hopefully find an answer. ![]() It was a great question, and, as usual with these types of one-off questions, I did not know the answer. Recently, I was asked a question that had been raised about an unusual entry in iOS Messages.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |