| App Name | Rakuten Viber Messenger |
| Bundle ID | com.viber |
| Developer | Viber Media SARL |
| Category | Communication |
| Initial Release | 2010-12-02 |
| Analyzed Version | 23.1.3 |
| Platform | iOS |
| Date performed | 01-26 |
| Verified? | False |
| Horizon Added? | True |
Base Path
/private/var/mobile/Containers/Data/Application/.*
/private/var/mobile/Containers/Shared/AppGroup/.*
File paths of interest with short notes of type of data:
Data:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/Attachments/.*.jpg | Attachment files, only see jpg currently | ||
| iCloud data | /private/var/mobile/Containers/Data/Application/.*/Documents/IcloudItemsMetadata/icloudItems.sqlite.* | TODO: Appears to be info on iCloud backup | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/UserEngagement/.* | Appear to be some “gif” files and other .svg files, might not be super useful | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/VoiceMessages/.* | TODO: Need to test this, see if anything is left here | **NEW P ** | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Library/Application Support/Adjust/AdjustIoActivityState.plist | TODO:** Need to test this, possible PoL | NEW T/P | pol |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/com.viber/Cache.db | TODO:** Possible account info, device info | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/com.viber/fsCachedData/.* | TODO:** Double check where these images come from | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/ViberIcons/.*.jpg | TODO:** Appear to be Profile pictures | NEW T/P | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/com.viber.plist | Some account info | ||
| media | /private/var/mobile/Containers/Data/Application/.*/Library/SplashBoard/.*/.*.ktx | Snapshot images, can contain deleted chat messages. | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Library/preRegisteredMixpanel.sqlite.* | Some Device info | NEW T/P | |
| media | /private/var/mobile/Containers/Data/Application/.*/tmp/CommunicationNotificationsAvatars/.* | Profile pictures | NEW T/P |
Shared:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/AttachmentsPreview/.*.jpg | Attachment previews of images | ||
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/chatFoldersdb/chatFolders.sqlite.* | Can contain info on chats that have been organized in folders | NEW T/P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/ContactIcons/.*.jpg | Contact profile pics | NEW T/P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/CustomLocationImage/.*.jpg | Image files that appear to show locations on map tiles. Not sure if these are shared or something else. | NEW T/P | Location |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/database/Contacts.data.* | Database containing contacts, conversations, messages, calls, and attachments | ||
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/settings/Settings.data.* | Settings database containing source actor information | NEW T | |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/SecureStorage.data.* | Needs tested/decrypted. Most of the contents is encrypted, so not super sure what is being stored. | NEW T/P |