Current status: doing forensics on my own iPhone to do the same sort of network data report as in that Bezos forensics report: 
It appears that not only can I track data usage, I can narrow it down to which App did the usage. In other words, that I can know if it was Snapchat, WhatsApp, or whatever that was responsible for the uploads.
Well, yes, it appears I can know from forensics which app is responsible for "unauthorized data exfiltration".
In other words, that forensics report could have told us which app was doing the "unauthorized exfiltration", but chose not to. Or the forensics is woefully incomplete.
So let's pop this data over from SQLite into Excel and graph traffic by date. We see that it's spikey, like Bezo's phone.
Hmm, that's a big spike at the end of June 2018. What apps are responsible for this traffic?
(FYI: this isn't actually my phone, but my sister's phone. I was confused as to which iPhone backup I was looking at).
The point is that we can drill down a bit better as to which app is doing the unusual traffic, and by how much.
BTW: this is something anybody can do:
* use iTunes to create a backup of your phone onto your computer
* use tools to extract the data, like "iPhone Backup Extractor"
* grab /private/var/wireless/Library/Databases/DataUsage.sqlite
* use SQLlite tools to browse this file
* use iTunes to create a backup of your phone onto your computer
* use tools to extract the data, like "iPhone Backup Extractor"
* grab /private/var/wireless/Library/Databases/DataUsage.sqlite
* use SQLlite tools to browse this file
To extract this data to save to CSV to import into Excel, I stole the query from:
github.com/mac4n6/APOLLO/…
Then I use excel tricks to sum by date:
=SUMPRODUCT($E$3:$E$2034*(INT($A$3:$A$2034)=G26))
github.com/mac4n6/APOLLO/…
Then I use excel tricks to sum by date:
=SUMPRODUCT($E$3:$E$2034*(INT($A$3:$A$2034)=G26))
I'm not an iPhone forensics expert, so don't quote me as such.
However, I am a person who has done this sort of forensics on iPhones.
However, I am a person who has done this sort of forensics on iPhones.
I mean, I'm not proving my competence to opine on this story by citing fancy credentials, I'm demonstrating my competence by reproducing the "exfiltration" graph on one of my own iPhones (the one I gave to my sister):
To repeat my conclusion from another thread: I see nothing in that FTI Bezos "forensics" report that suggests Bezos's phone was hacked.
vice.com/en_us/article/…
vice.com/en_us/article/…
