TY - GEN
T1 - iOS Cookie Forensics with Autopsy Tool
AU - Adila, Rida
AU - Nusantara, Adetiya B.
AU - Studiawan, Hudan
AU - Choo, Kim Kwang Raymond
N1 - Publisher Copyright:
© ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering 2027.
PY - 2027
Y1 - 2027
N2 - The use of iOS devices has increased due to Apple’s popularity and the seamless integration of hardware and software. As internet technology grows, browsers on iOS devices become important for communication and information access. These browsers hold valuable evidence, particularly cookies, which are small files storing browsing data. Analyzing these cookies helps uncover information about a user’s online behavior. This research proposes a module within Autopsy for parsing cookies from iOS forensic images. This module supports direct viewing and forensic analysis of parsed cookie files obtained from iOS devices by combining two key stages: (1) reverse engineering of the binary cookie file format to understand its structure and (2) development of a custom cookie parser module using Apache NetBeans, which integrates into Autopsy for simplified analysis. It aims to improve the ability of forensic investigators to explore iOS devices and uncover hidden information within cookies. Experiments show that the proposed module has been successfully integrated as a plugin in Autopsy. It is capable of parsing cookie files from iOS forensic images and displays structured cookie data, including URL, name, path, value, and timestamps, directly within the Autopsy’s data content viewer.
AB - The use of iOS devices has increased due to Apple’s popularity and the seamless integration of hardware and software. As internet technology grows, browsers on iOS devices become important for communication and information access. These browsers hold valuable evidence, particularly cookies, which are small files storing browsing data. Analyzing these cookies helps uncover information about a user’s online behavior. This research proposes a module within Autopsy for parsing cookies from iOS forensic images. This module supports direct viewing and forensic analysis of parsed cookie files obtained from iOS devices by combining two key stages: (1) reverse engineering of the binary cookie file format to understand its structure and (2) development of a custom cookie parser module using Apache NetBeans, which integrates into Autopsy for simplified analysis. It aims to improve the ability of forensic investigators to explore iOS devices and uncover hidden information within cookies. Experiments show that the proposed module has been successfully integrated as a plugin in Autopsy. It is capable of parsing cookie files from iOS forensic images and displays structured cookie data, including URL, name, path, value, and timestamps, directly within the Autopsy’s data content viewer.
KW - Autopsy
KW - digital forensics
KW - iOS cookie files
KW - reverse engineering
UR - https://www.scopus.com/pages/publications/105046830847
U2 - 10.1007/978-3-032-22542-9_14
DO - 10.1007/978-3-032-22542-9_14
M3 - Conference contribution
AN - SCOPUS:105046830847
SN - 9783032225412
T3 - Lecture Notes of the Institute for Computer Sciences, Social-Informatics and Telecommunications Engineering, LNICST
SP - 225
EP - 240
BT - Digital Forensics and Cyber Crime - 16th EAI International Conference, ICDF2C 2025, Proceedings
A2 - Choo, Kim-Kwang Raymond
A2 - Perez-Pons, Alexander
A2 - Upadhyay, Himanshu
A2 - Lu, Rongxing
A2 - Chow, Kam Pui
PB - Springer Science and Business Media Deutschland GmbH
T2 - 16th EAI International Conference on Digital Forensics and Cyber Crime, ICDF2C 2025
Y2 - 17 November 2025 through 19 November 2025
ER -