The Houseparty app keeps user generated data in in the following Realm database:
/private/var/mobile/Containers/Data/Application/*GUID*/Documents/For details on how to jailbreak an iOS device see here: https://www.doubleblak.com/blogPosts.php?id=12. Lots of detail on how to use Checkra1n so a full file system data dump can be extracted for analysis.
houseparty.rocky.realm
For details on Real databases and how to approach their examinations see here: https://abrignoni.blogspot.com/2019/11/realm-database-storage-primer-for.html
It is of note that Cellebrite Physical Analyzer has a database browser that is compatible with Realm databases.
Update
Video version of this blog post:
Long version:
Due to Covid-19, and the fact that social interactions in person have been limited because of it, a slew of group video chat applications have taken off in popularity. One of those is Houseparty for all major operating systems. This post will deal with the iOS version of the app.
For this analysis I used the excellente public test image created by Josh Hickman (@josh_hickman1). His images have detailed documentation regarding what apps were used, what user activity was generated, and when. This process is key when dealing with an unknown app or one that is not parse by commercial tools. You can get these excellent test images here:
https://thebinaryhick.blog/2020/04/16/ios-13-images-images-now-available/
In order to investigate a non-parsed app the process I recommend is to generate a known data set collection. That way one is aware of what to look for while trying to decipher how is the data stored. In this case Josh's image, since it is so well documented, will serve as our research platform.
Our test image has the following documented activity:
https://github.com/abrignoni/iLEAPP
After processing a report is generated. For simplicity I limited the report to the applicationstate.db artifact. This is the database that iOS uses to keep track of what apps are installed and where.
https://offcornerdev.com/bundleid.html
The path to follow is under the Sandbox Path column. Notice how app directories in iOS are identified by a long GUID number. This is why querying the applicationstate.db is so important. It is the fastest way to determine what GUID name directory corresponds to the app of interest.
After arriving to the target directory we find the usual app structure for iOS apps.
Inside the documents folder is our data store of interest. A Real file named houseparty.rocky.realm.
In order to view the contents of this data store one has to have Realm Studio installed on our analysis computer. Real Studio can be found here:
https://realm.io/products/realm-studioAfter opening the data store three classes are of interest. The first one is RealNote. This one contains the expected chats with recipient IDs and timestamps.
The second one is RealmPublicUser. This class contains information about the message recipients.
The third one is RealLocalContact. It has additional information of the local user account for the app.
One way of reporting the contents of these data stores is to export the contents to JSON.
With the data in JSON format one can extract whatever classes are needed for reporting purposes.
A quick triage way to visualize the data without the needing Real Studio is to process the exported JSON file through a JSON to HTML converter. One can be found here:
https://github.com/abrignoni/JSON-to-HTML-and-XLSThis conversion helps, in my opinion, the user see delimiting lines between keys and values more easily.
Conclusion
Realm databases are becoming more prevalent in mobile analysis. We will be well served in practicing how to approach these new data stores. I believe they could possibly replace SQLite databases in the future.
As always, I can be reached on twitter @AlexisBrignoni and email 4n6[at]abrignoni[dot]com.
