While helping some investigators out I realized that my some of my APOLLO knowledgeC modules needed a bit of updating. Naturally I thought it would be quick, but it turned into quite an extensive update. I’ve included lots of brand-new modules as well as updates to ones that I’ve had before.
Most of the updates to the older ones provided better backwards compatibility with older versions of macOS and iOS as well as adding additional contextual items to some of the queries from ZSTRUCTUREDMETADATA. Regression testing was performed on iOS 11, 12, and 13 and macOS 10.13, 10.14, and 10.15. Of course, please let me know if you run into a knowledgeC “stream” that I’ve not created a module for, or any issues that you might come across.
I’ve highlighted a few modules below using my iOS 13.5 device. However, they may also apply to macOS and older iOS versions as well – review the modules for more documentation.
New Modules:
knowledge_activity_level_feedback.txt
knowledge_airplay_prediction.txt
knowledge_calendar_event_title.txt
knowledge_charging_smart_topoff_checkpoint.txt
knowledge_dasd_battery_temperature.txt
knowledge_device_locked_imputed.txt
knowledge_discoverability_usage.txt
knowledge_event_tombstone.txt
knowledge_inferred_microlocation_visit.txt
knowledge_knowledge_sync_addition_window.txt
knowledge_photos_edit_all.txt
knowledge_photos_deletes_all.txt
knowledge_photos_deletes_recent.txt
knowledge_photos_engagement.txt
knowledge_photos_share_airdrop.txt
knowledge_photos_share_all.txt
knowledge_photos_share_extension.txt
knowledge_segment_monitor.txt
knowledge_siri_activites.txt
knowledge_siri_flow_activity.txt
knowledge_sync_addition_window.txt
knowledge_sync_deletion_bookmark.txt
knowledge_user_first_backlight_after_wakeup.txt
The knowledge_app_activity_passbook.txt module was added to conveniently look for Apple Wallet (com.apple.Passbook) activity. Shown below I’m switching between my Apple Cash card and my Apple Card (yes, I got one for “research”).
The knowledge_photos_deletes_all.txt module appears to keep track of when I deleted a photo from the Photos app. This output is fairly vague. However, it could be useful in evidence destruction cases. The output of this one is similar to the other knowledge_photos_* modules.
Want to know if a thing was AirDrop’ed, copied, searched for, or otherwise interacted with from the iOS ShareSheet? The knowledge_sharesheet_feedback.txt module will help with that! Shown below, this module is keeping track of:
Photo Markups (com.apple.MarkupUI.Markup.MarkupPhotoExtension) via Camera App (com.apple.camera)
File Copies (com.apple.UIKit.activity.CopyToPasteboard) in Photos (com.apple.mobileslideshow)
Sending a photo in Messages (com.apple.MobileSMS) via Photos app (com.apple.mobileslideshow)
Finding text in a webpage (com.apple.mobilesafari.activity.findOnPage) in Safari (com.apple.mobilesafari)
Airdrop Activity (com.apple.UIKit.activity.AirDrop)
Some modules are fairly self-explanatory. The knowledge_system_airplane_mode.txt modules keeps track of whether Airplane Mode on the device is enabled or not.
The next two are associated with the iOS low power mode functionality. The first, knowledge_device_battery_saver.txt which shows that I’ve activated Low Power Mode via the Control Center and while knowledge_device_low_power_mode.txt shows that it was turned on about two seconds after.
Click for larger view.
Updated Modules:
knowledge_activity_level.txt
knowledge_app_activity.txt
knowledge_app_activity_calendar.txt
knowledge_app_activity_clock.txt
knowledge_app_activity_mail.txt
knowledge_app_activity_maps.txt
knowledge_app_activity_notes.txt
knowledge_app_activity_photos.txt
knowledge_app_activity_safari.txt
knowledge_app_activity_weather.txt
knowledge_app_install.txt
knowledge_app_intents.txt
knowledge_app_location_activity.txt
knowledge_audio_bluetooth_connected.txt
knowledge_audio_output_route.txt
knowledge_device_batterylevel.txt
knowledge_device_inferred_motion.txt
knowledge_device_is_backlit.txt
knowledge_device_locked.txt
knowledge_device_pluggedin.txt
knowledge_discoverability_signals.txt
knowledge_notification_usage.txt
knowledge_paired_device_nearby.txt
knowledge_portrait_entity.txt
knowledge_portrait_topic.txt
knowledge_app_relevantshortcuts.txt
knowledge_safari_browsing.txt
knowledge_settings_doNotDisturb.txt
knowledge_siri.txt
knowledge_standby_timer.txt
knowledge_widgets_viewed.txt
The module knowledge_app_inFocus.txt has added extensions context. The extensions below show a location sign-in alert (com.apple.AuthKitUI.AKLocationSignInAlert) via the Springboard (com.apple.springboard), access to the Camera (com.apple.camera) via Messages (com.apple.MobileSMS), and access to Photos (com.apple.mobileslideshow) via Messages. All the while, playing around with the Unc0ver Jailbreak (science.xnu.undecimus).
New with knowledge_app_webusage.txt are the “Digital Health” columns. These will show website visits and associated URLs on various apps (not just Safari or Chrome!).
In this example I was using Twitter (via Safari) on a device with the macOS hardware UUID (or iOS UDID) in Device ID column - let’s say my laptop. On my iPhone, I was also on Twitter but this time the iOS application (com.atebits.Tweetie2) ordering a new t-shirt from Jailbreak Brewery.
Additions to knowledge_audio_media_nowplaying.txt include:
Is AirPlay Video
Playing – Values likely for Stopped, Playing, Paused – I will test those and update those in a future update.
Duration
Elapsed
Identifier
Media Type – Audio, Music, Video, Podcast
Output Device IDs (Binary plist in hex)
This is only a small slice of knowledgeC examples (and a very small part of APOLLO) so I hope this gives you some incentive to give it a try!