| App Name | Rakuten Viber Messenger |
| Bundle ID | com.viber |
| Developer | Viber Media SARL |
| Category | Communication |
| Initial Release | 2010-12-02 |
| Analyzed Version | 27.0.4 |
| Platform | iOS |
| Date performed | 01-27-2026 |
| Verified? | True |
| Horizon Added? | True |
Base Path
/private/var/mobile/Containers/Data/Application/.*
/private/var/mobile/Containers/Shared/AppGroup/.*
File paths of interest with short notes of type of data:
Data:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/Attachments/.*.jpg | Attachment files, only see jpg currently | ||
| media | /private/var/mobile/Containers/Data/Application/./Documents/IcloudItemsMetadata/icloudItems.sqlite. | This appears when iCloud backup is turned on with Viber turned on | ||
| data | /private/var/mobile/Containers/Data/Application/.*/Documents/FileMessages/.* | Files sent through chat | NEW P | |
| log | /private/var/mobile/Containers/Data/Application/.*/Documents/releaseLogs/release.log | Can contain actor phone #, info on when app was registered | NEW P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Documents/VoiceMessages/.* | Voice messages in chat | ||
| data | /private/var/mobile/Containers/Data/Application/.*/Library/Application Support/Google/Ads/OnDeviceConversation/com.google.ads.on_device_conversion.plist | First launch timestamp | NEW T/P | pol |
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/com.viber/Cache.db.* | Registered phone #, first session time, install time | NEW P | pol |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/com.viber/fsCachedData/.* | Cached images | NEW P | |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/Caches/ViberIcons/.*.jpg | Can contain profile pictures | NEW P | |
| plist | /private/var/mobile/Containers/Data/Application/.*/Library/Preferences/com.viber.plist | Settings files containing source actor information | ||
| sqlite | /private/var/mobile/Containers/Data/Application/.*/Library/preRegisteredMixpanel_MPDB.sqlite.* | Information on account activation, verify phone #, device info, carrier info, OS info | NEW T/P | pol |
| media | /private/var/mobile/Containers/Data/Application/.*/Library/SplashBoard/Snapshots/sceneID/com.viber-default/.*.ktx | Snapshot images, can contain deleted chat messages. | ||
| media | /private/var/mobile/Containers/Data/Application/.*/tmp/ViberIcons/.* | Can contain profile pics of contacts | NEW T/P |
Shared:
| Artifact Type | Path | Notes | New Artifact | Tags |
|---|---|---|---|---|
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/AttachmentsPreview/.*.jpg | Attachment previews of images | ||
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/AvatarsIcons/.*.jpg | Actor profile pictures | NEW T/P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/BigAttachmentsPreview/.* | TODO: Try sending bigger attachements | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/chatFoldersdb/chatFolders.sqlite.* | Can contain info on chats that have been organized in folders | NEW T/P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/ContactIcons/.* | Empty this round, possibly moved to ViberIcons | NEW P | |
| media | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/CustomLocationImage.*.jpg | This appears after location is shared in chat, images of shared locations | NEW P | |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/database/Contacts.data.* | Database containing contacts, conversations, messages, calls, and attachments | ||
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/datingDatabase/dating.sqlite.* | TODO: db currently empty, but appears it can contain profile info on that person, possibly profile picture | NEW T/P | |
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/com.viber/settings/Settings.data.* | Settings database containing source actor information | ||
| sqlite | /private/var/mobile/Containers/Shared/AppGroup/.*/SecureStorage.data.* | Needs tested/decrypted. Most of the contents is encrypted, unsure of contents | NEW T/P |