| Artifact |
Notes |
New? |
Tag |
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-TAMStorage/echo/AdvancedCrypto/.*.(thd|msg) |
Seems to have message files, but not sure if they are saved or archived |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-TAMStorage/echo/AdvancedCrypto/.*/fts.db |
Appears to contain messages, attachment info |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-TAMStorage/echo/AdvancedCryptoLocal/.*/ACT_AppData_Messages/.*.actadm |
Appears to contain mapping of deleted messages. Can find message within fts.db |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-TAMStorage/echo/AdvancedCryptoLocal/.*/ACT_Downloaded_Attachments/.*.actda |
Appears to contain mappings of messages and their attachments |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-TAMStorage/media_bank/AdvancedCrypto/.*/persistent/.*.jpg |
TODO: Attachment files, need to confirm if they are "preview" of the attachments |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-userDatabases/.*.db.* |
Decrypted lightspeed-.db file (logged in user) containing actors, groups, attachments, messages, payment info, user contact info, WhatsApp info (if connected), possible location info |
|
Location, Payment |
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-userDatabases/crypto_db_.*.db.* |
Actor IDs, encryption info (TODO: need to confirm encrypted items), location, IP network, settings, some call data |
NEW T/P |
Location, Account, Network |
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Application Support/lightspeed-userDatabases/reverb_db_.*.db.* |
Actor IDs, more messages (TODO: they seem to be different from the other db with messages), deleted messages |
NEW T/P |
|
/private/var/mobile/Containers/Shared/AppGroup/.*/Library/Caches/lightspeed-imageCache/.* |
Cached images, can be user profiles, shared locations, etc. |
NEW T/P |
Location |
/private/var/mobile/Containers/Shared/AppGroup/.*/notif/temp_nce_media/.*/mid.*/.* |
Appears to be image files, not sure if they are cached or temp files |
NEW T/P |
|