WE REPORT FEWER INSTALLED APPS NOW. THAT IS THE FIX.
That number on the card went from 3,981 to 791 and it is the thing I am proudest of in this release.
In 2018 I wanted a list of the apps installed on an iPhone. I thought that was one question. It is at least six, and no single artifact answers all of them.
So we tested it properly, iOS 12 through iOS 26, every registered test image we have. The old installed summary had been counting app extensions, malformed bundle IDs, and apps known only from container activity. Strip those out and the count drops by 80 percent. Nothing was thrown away. It moved to a table whose label says exactly what the evidence supports, and the historical view got bigger at the same time, 9,575 rows to 11,786.
The history got bigger. The claim got smaller. That is the trade I want every time.
My favorite detail: on one public test image, two apps being removed produced seventeen container destruction rows in nine seconds, because every app extension owns its own container. Read those rows as apps and you would report a phon
... show moreWE REPORT FEWER INSTALLED APPS NOW. THAT IS THE FIX.
That number on the card went from 3,981 to 791 and it is the thing I am proudest of in this release.
In 2018 I wanted a list of the apps installed on an iPhone. I thought that was one question. It is at least six, and no single artifact answers all of them.
So we tested it properly, iOS 12 through iOS 26, every registered test image we have. The old installed summary had been counting app extensions, malformed bundle IDs, and apps known only from container activity. Strip those out and the count drops by 80 percent. Nothing was thrown away. It moved to a table whose label says exactly what the evidence supports, and the historical view got bigger at the same time, 9,575 rows to 11,786.
The history got bigger. The claim got smaller. That is the trade I want every time.
My favorite detail: on one public test image, two apps being removed produced seventeen container destruction rows in nine seconds, because every app extension owns its own container. Read those rows as apps and you would report a phone shedding seventeen. It shed two.
An inventory and a stack of receipts are both useful. They are not interchangeable.
Link in bio.
#DFIR #DigitalForensics #MobileForensics #iOS #OpenSource #ForensicScience #Infosec
