The iOS TikTok app keeps message related data the TIMMessageORM table from the following SQLite database:
/private/var/mobile/Containers/Data/Application/UU-ID/Library/Application Support/ChatFiles/User-ID/db.sqliteBe aware that in the path UU-ID should be replaced by the application identifier and the User-ID for TikTok user identifier of interest. The process to obtain the correct UU-ID number is presented in brief in the long version section. For a detailed example see here. To obtain the correct User-ID directory number for a user of interest see the contents of the awemecontacts table from the following SQLite database:
/private/var/mobile/Containers/Data/Application/UU-ID/Documents/AwemeIM.dbQueries that can be used as templates to extract messages from the database can be found at:
https://github.com/abrignoni/DFIR-SQL-Query-Repo/tree/master/iOS/TIKTOKIn order to view the public TikTok profiles of the users found in the awemecontacts table in the AwemeIM.db database add the user name ID to the end of the following URL:
https://m.tiktok.com/h5/share/usr/(insert username ID number from DB).htmlFor one of the test accounts used in this blog post the URL looks like this:
https://m.tiktok.com/h5/share/usr/6619782258185388037.html
Videos created with the app can be found in the following directory with the .mp4 extension:
/private/var/mobile/Containers/Data/Application/UU-ID/temp/Long version
TikTok is one of the most popular apps in the iOS App Store.
Testing Platform
For analysis I am using the following device and equipment:
- iPhone SE - A1662
- iOS 11.2.1
- Jailbroken - Electra
- Forensic workstation with Windows 10 and SSH software.
Acquisition
A brief overview of the identification and extraction of TikTop user data app directory is as follows. For an detailed example see here.
1. Locate bundle id name.
2. Access the 'applicationState.db' file located at:
This SQLite database provided the connection between the bundle id and the UUID numbers in the 'Application' directory.
Open the SQLite database with a SQLite browser. Look for the bundle id name in the 'application_identifier_tab' table. Take note of the corresponding id number.
3. Look for it in the 'kvs' table in the 'application_identifier' field . Export the blob in the value field for the id. The exported data is a bplist that maps all pertinent UUID numbers to the application name and/or bundle id. The data can also be seen in the preview pane in binary mode without the need to export the blob content. If the bplist is exported a viewer, like Sanderson Forensics BPlister, can be used to see the relationship between UUID and application we are looking for.
4. With the correct application directory identified I copied it via SSH to the forensic workstation.
In this particular instance I did not make a full file system extraction of the device. I only copied the app directory of interest for testing purposes. Do follow generally accepted forensic principles when doing similar work on your case work.
Chats and Media
As stated in the Short version portion of the blog post the message data can be accessed by joining the contents of two different databases and two tables in them.
1. TIMMessageORM.db.sqlite
2. awemecontacts.AwemeIM.db
The paths for these files are respectively:
1. Support/ChatFiles/User-ID/db.sqlite
2. /private/var/mobile/Containers/Data/Application/UU-ID/Documents/AwemeIM.db
The messages query found in the DFIR SQL Query Repo for TikTok produces the following results:
The column data is as follows:
1. sender = The numeric user id. The value is used to join the two tables in order to access usernames.
2. profilepicURL = Is the link for the user profile pic.
3. customID = Account username.
4. nickname = Precisely what it says.
5. Local_create_Time = Local/device time for a particular message.
6. servercreatedat = Server/remote time for a particular message. A value of zero indicates the message did not leave the device.
7. message = The content of the message.
8. localresponse = Additional information for a particular message. For example for messages that did not leave the device this field will provide some diagnostic information.
9. links_display_name = If the user responds with an image or a gif this field will have the display name of the file.
10. links_gif_url = The link for the sent image of gif. Contents can be accessed without authentication.
The user data query found in the DFIR SQL Query Repo for TikTok produces the following results:
A brief overview of the identification and extraction of TikTop user data app directory is as follows. For an detailed example see here.
1. Locate bundle id name.
2. Access the 'applicationState.db' file located at:
/private/var/mobile/Library/FrontBoard/
This SQLite database provided the connection between the bundle id and the UUID numbers in the 'Application' directory.
Open the SQLite database with a SQLite browser. Look for the bundle id name in the 'application_identifier_tab' table. Take note of the corresponding id number.
3. Look for it in the 'kvs' table in the 'application_identifier' field . Export the blob in the value field for the id. The exported data is a bplist that maps all pertinent UUID numbers to the application name and/or bundle id. The data can also be seen in the preview pane in binary mode without the need to export the blob content. If the bplist is exported a viewer, like Sanderson Forensics BPlister, can be used to see the relationship between UUID and application we are looking for.
4. With the correct application directory identified I copied it via SSH to the forensic workstation.
In this particular instance I did not make a full file system extraction of the device. I only copied the app directory of interest for testing purposes. Do follow generally accepted forensic principles when doing similar work on your case work.
Chats and Media
As stated in the Short version portion of the blog post the message data can be accessed by joining the contents of two different databases and two tables in them.
1. TIMMessageORM.db.sqlite
2. awemecontacts.AwemeIM.db
The paths for these files are respectively:
1. Support/ChatFiles/User-ID/db.sqlite
2. /private/var/mobile/Containers/Data/Application/UU-ID/Documents/AwemeIM.db
The messages query found in the DFIR SQL Query Repo for TikTok produces the following results:
The column data is as follows:
1. sender = The numeric user id. The value is used to join the two tables in order to access usernames.
2. profilepicURL = Is the link for the user profile pic.
3. customID = Account username.
4. nickname = Precisely what it says.
5. Local_create_Time = Local/device time for a particular message.
6. servercreatedat = Server/remote time for a particular message. A value of zero indicates the message did not leave the device.
7. message = The content of the message.
8. localresponse = Additional information for a particular message. For example for messages that did not leave the device this field will provide some diagnostic information.
9. links_display_name = If the user responds with an image or a gif this field will have the display name of the file.
10. links_gif_url = The link for the sent image of gif. Contents can be accessed without authentication.
The user data query found in the DFIR SQL Query Repo for TikTok produces the following results:
The column data is as follows:
1. uid = Numeric user id.
2. customID = Account username.
3. nickname = Precisely what it says.
4. latestchattimestamp = Last timestamp for a chat.
5. url1 = Link for the profile pic of the user.
One can use the uid number to access the public profile of the user over a browser. Just user the following URL and fill it with the uid of interest.
https://m.tiktok.com/h5/share/usr/(insert username ID number from DB).htmlHere is one of my test account profiles as an example:
Videos created with the app can be found in the following directory with the .mp4 extension:
/private/var/mobile/Containers/Data/Application/UU-ID/temp/Conclusion
The TikTop app, both in Android and iOS, stores JSON data within SQLite databases. Currently I don't know of any mayor forensic tool vendor that has the json_extract function enabled in their SQLite implementations. This means that queries that can handle JSON data can't be incorporated into their artifact/template generation tools except via the use of more complex JSON handling python scripts.
For the time being exporting the databases of interest and executing SQL queries on them via a third party SQLite browser tool will be my preferred choice.
As always I can be reached on twitter @alexisbrignoni and email 4n6[at]abrignoni[dot]com.
