|
|
| App Name |
Signal iOS |
| Bundle ID |
org.whispersystems.signal |
| Developer |
TODO |
| Category |
Communication |
| Initial Release |
TODO |
| Analyzed Version |
7.21.0.277 |
| Platform |
iOS |
| Date performed |
03/02/2026 |
| Verified? |
False |
| Source |
CTF image |
| Horizon Added? |
True |
File paths of interest with short notes of type of data:
org.whispersystems.signal
Data:
- /private/var/mobile/Containers/Data/Application/.*/Library/Caches/.*-thumbnails/.*.jpg (Tag: Location) (New P cached image thumbnails, can include map tiles)
- /private/var/mobile/Containers/Data/Application/.*/Library/Caches/Logs/.*.log (New T/P log files)
- /private/var/mobile/Containers/Data/Application/.*/Library/Splashboard/Snapshots/sceneID/org.whispersystems.signal-default/.*.ktx (Snapshots, can be images of old messages, etc)
Shared:
- /private/var/mobile/Containers/Shared/AppGroup/.*/Attachments/.*.(jpg|jpeg) (New T/P attachment image files)
- /private/var/mobile/Containers/Shared/AppGroup/.*/AvatarHistory/.*.jpg (New T/P History of avatar)
- /private/var/mobile/Containers/Shared/AppGroup/.*/grdb/signal.sqlite.* (ENCRYPTED db) (Tag: Account) (NEEDS KEY “confirm from keychain”)(Signal iOS GRDB database (encrypted) with source actor information, contacts, messages, and attachments)
- /private/var/mobile/Containers/Shared/AppGroup/.*/Library/Caches/AvatarBuilder/.*.png (New T/P Appears it could contain user avatar or profile picture)
- /private/var/mobile/Containers/Shared/AppGroup/.*/NSELogs/org.whispersystems.signal.SignalNSE.*.log (Tag: PoL) (New T/P Logs containing some device info, TODO: Possibly PoL data)
- /private/var/mobile/Containers/Shared/AppGroup/.*/ProfileAvatars/.*.jpg (New T/P User Profile pictures)