Introduction
The Mobile Application Forensics team has begun to wrap up analysis on their second mobile app, Bumble, and are getting ready to move onto their next set of mobile apps, Facebook Lite for Android and the Weather Channel App for iOS. During analysis, both the iOS and Android team found important digital artifacts left behind by Bumble, which can be viewed in the Analysis section of this blog.
As we have already reached the halfway mark of the school semester, our plan is to examine two more mobile applications within the next month. The iOS team plans to look into the Weather Channel mobile app, and Tumblr, and the android team plans to look at Facebook Lite, and Strava.
Analysis
iOS
To find artifacts created by Bumble, the iOS team used UFED to image the iPad Air, and UFED Physical Analyzer to parse through the image. Data for Bumble was located in Sam’s iPad/Applications/com.moxco.bumble. Within /com.moxco.bumble, there is a /Documents/yap-database.sqlite/database2 database, which contained pLists for the Bumble account. Within this database, we found the username for the Bumble account “Sam” within the userName pList, and the user ID “1409166234” for Sam in the userID pList. Both of these pLists can be viewed below.
Within the /yap-database.sqlite/database2 database, we also found a settings pList which contained settings information in regards to generating a list of potential Bumble matches. Within this pList, we found keys for the user’s preferred age group (“fromAgeValue” and “toAgeValue”), radius, in miles, that the user set to search for matches (“distance”), whether the user had Vibee enabled (vibeeEnabled), and the user’s preferred gender (“femaleShown” and “maleShown”).
The “fromAgeValue” and “toAgeValue” key, defined as years, determines how many years the user wants to go below/above from their current age. The value for “distance”, represented in miles, sets the maximum radius for people that get added to the user’s search list. The “vibeeEnabled” key shows whether the user has VIBee status of not. The VIBee feature is designed to connect users who have had positive interactions on Bumble together. The “femaleShown” key and “maleShown” key sets whether the account is looking for a male or female match. The settings pList can be viewed below.
Also within the /yap-database.sqlite/database2 database, we found a pList titled lastLocation, which contained information regarding the last location Bumble logged for our user. This pList can be viewed below.
Android
The Android team found all of their digital artifacts within the com.bumble.app folder inside userdata/Root/data. Within com.bumble.app are three subdirectories (com.bumble.app/files, com.bumble.app/databases, and com.bumble.app/cache) that held the most information relevant for a mobile investigation. The first subdirectory we are going to look at is com.bumble.app/files.
com.bumble.app/files
Within the com.bumble.app/files folder, was a document titled c2V0dGluZ3M= or “settings” (once you throw c2V0dGluZ3M= through a base64 converter, it decodes to “settings”). Inside the settings file, we found profile information such as the user’s username, user’s data of birth, user ID, email associated with the account, and a link to the user’s profile image. Inside this file, there was also information regarding the user’s preferred language and country on profile. It was through finding this information, that we concluded information stored within the /files directory are files that contain user information. Below is a screenshot of the user ID we found within the /settings file inside the com.bumble.apps/files folder.
com.bumble.app/databases
Within the badoo.db database inside com.bumble.apps/databases, we were able to recover the messages sent from the Nexus 5x to the Google Pixel. Along with text-based messages, we were able to see that an image was sent from the Nexus 5x to the Pixel, along with the location of that image on our mobile device. Using the user ID we found in the settings file within the /files folder, we were able to pick out who sent what message. Below, is an image showing the badoo.db database within userdata/Root/data/com.bumble.app/databases that contained the text messages we sent, along with sender and recipient information, and timestamp information.
com.bumble.app/cache
Within the com.bumble.app/cache folder, we found two folders (/decorator and /downloader) and a file that contained links to images on our user’s profile. The /decorator folder contained images that the user directly interacted with, e.g., images sent or received through Bumble, and images stored on the profile the user interacted with. The /downloader folder contained all the images the user saw while they were using the app. Below is an image that was stored inside the /decorator folder, which our user received from the Bumble user on the Google Pixel.
Within the /downloader folder were all the images the user saw the last time they used the app. This includes the profile pictures of other users we saw when using the app. For privacy reasons, a screenshot of this will not be included in this report.
Conclusion
The iOS team found most of their data within pLists inside the /yap-database.sqlite/database2 database in /Applications/com.moxco.bumble. Through looking through the /yap-database.sqlite/database2 database, the iOS team was able to recover username information, the user’s ID, user’s last known location, and account preferences set by the user. Although the iOS team was able to find a lot, we were unable to find any of the messages sent, or received through Bumble.
The Android team was able to find user account data on Bumble, chat data, and images associated with our account, and the accounts we interacted with.
With the Mobile Application Forensic team wrapping up analysis on Bumble, and shifting their focus on their third set of apps, we hope to publish an interesting and informative report at the end of the semester. Stay tuned!
Questions or comments? Please share with us in the comment section below! You can also reach out to our Twitter and Facebook or email us at lcdi@champlain.edu.