# iOS Artifact Analysis

> Master iOS artifact analysis. Learn to extract and parse critical data from iOS backups, including SMS, call logs, app data, and location history.

Canonical: https://codelivly.com/rooms/ios-artifact-analysis
Last updated: 2026-09-16

| | |
|---|---|
| Level | Intermediate |
| Category | Forensics |
| Lessons | 4 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into the analysis of digital artifacts specific to Apple's iOS ecosystem. You will learn how to navigate the iOS file system structure within iTunes-style backups, locate and parse critical SQLite databases (like sms.db and call_history.db), analyze property list (.plist) files, and extract location history and application usage data. By mastering iOS artifact analysis, you will be able to reconstruct user activity, track suspect movements, and uncover hidden communications for corporate and legal investigations.

## Lessons

1. What Are iOS Artifacts and Why Do They Matter (30 min)
2. iOS File System & Sandbox Structure (30 min)
3. Analyzing iTunes/Finder Backups and plist Files (30 min)
4. Guided Lab: Parsing an iOS Backup for Evidence (30 min)

## Related

- [Learning path: Mobile Device Forensics](https://codelivly.com/learning-paths/mobile-device-forensics)
- [All rooms](https://codelivly.com/rooms)