<Thread> It’s 5:30am and I’m at the airport. Few days ago, M. X called me. He is the CEO of a big company and he thinks that one of his competitors hacked his phone. I’m going to the company HQ to analyse his phone and evaluate the situation.

This is my first post-lockdown flight. Even if the lockdown ended a while ago and the situation is under control in France, the majority of flights are still cancelled and the airport is empty. We are in the middle of the summer holidays, it should be full of people in theory.

This view is amazing.

Bonus game: #GEOINT experts, what city is in the first photo?

Obviously, this is not my final destination. I’m not that stupid https://twitter.com/fs0c131y/status/1286530861756809219?s=21 https://twitter.com/fs0c131y/status/1286530861756809219

I’m on site. The fun can start!

Let see what this phone has to tell me

Thanks to the awesome @ElcomSoft iOS Forensic kit, I have now an image of the phone with all the data https://www.elcomsoft.fr/eift.html 

The phone has more than 41000 location data points saved. You should really turn off your location people

I used APOLLO to analyse the data and generate kmz files https://github.com/mac4n6/APOLLO 

Once you have the kmz files, you can use Google Earth Pro to open it.

Yes, iOS has a dedicated database to keep the history of where you parked your vehicule...

Thanks to @ElcomSoft Phone Viewer, you can view the Wifi history with the location. So, now I know where he went for holidays since he bought his phone. I also know where he bought his phone because the phone was connected to the store Wifi.

Worth to say:
- Turn off your wifi if you don't need it
- Clear regularly the Wifi history in your phone https://twitter.com/fs0c131y/status/1286606074313875457?s=20

You should clear regularly your web history too #JustSaying

The level of details is insane you have a log to know when the torch has ben used

The previous screenshot is coming from the report generated by the very good iLEAPP made by @AlexisBrignoni https://github.com/abrignoni/iLEAPP

I'm back from lunch. It's time to look at the keychain baby