Forensic Discoverability of iOS Vault Applications

Abstract

Vault Applications store potentially sensitive information on a smartphone; and are available on Android and iOS. Using these applications could be used to hide potential evidence or illicit photos. After comparing five iOS photo vaults, each vault left evidence and photos behind. However, of the three forensic toolkits used, each produced different results in their scans of the phone. The media left behind was due to the photo vaults not protecting their information as claimed and using basic obfuscation techniques in place of security controls. Future research will look at how newer security controls are implemented and if they are easily discoverable.