Type Apple SEGB XML
| Defined Constant | Type_Apple_SEGB_XML
|
| File Type Value | 1200 |
| Parent Type | Type_XML |
| Carve | No |
| Format Details | No |
| MIME Type | text/xml
|
| Filename Extension | xml
|
SEGB (XML)
Description
Apple SEGB as XML. This file is produced when Truxton exploits a SEGB file.
Apple is storing huge amounts of information in these files. Forensically exploiting hundreds of different types of record is challenging. As time passes, Truxton will exploit more of these records. In the interim, Truxton will produce this XML file so it can be indexed and be made marginally useful for investigators.
Sample
Here's a representation of the XML produced from a SEGB file. If data is present in a record (state 1), it will be converted to XML, automatically recursing into plist or protobuf data. Integer and floating point values are checked for valid timestamp ranges and turned into something humanly readable.
Line 6 shows a protobuf byte array being interpreted as a binary plist.
Line 14 shows the embedded binary plist data value contains a protobuf.
Line 19 shows interpreting an integer value as a timestamp.
Line 25 shows interpreting a binary plist floating point value as a timestamp.
Line 39 shows interpreting a protobuf fixed64 value as a floating point timestamp.
1 <?xml version="1.0" encoding="UTF-8" standalone="yes"?>
2 <segb version="1" recordcount="374" created="2021-10-17T02:10:23.128757Z">
3 <record offset="56" state="3" created="2021-10-13T13:59:24.589278Z"></record>
4 <record offset="8303392" state="1" created="2021-10-17T02:10:22.559643Z">
5 <f1 type="array" offset="8351623" length="10437">
6 <plist version="1.0" offset="8351623" length="10437">
7 <dict>
8 <key offset="8351641" length="8">$version</key>
9 <integer offset="8351674" length="4">100000</integer>
10 <key offset="8352445" length="4">$top</key>
11 <dict>
12 <key offset="8351753" length="7">NS.data</key>
13 <data offset="8351764" length="10107">
14 <f1 type="array" offset="8351766" length="19">com.apple.mobilecal</f1>
15 <f3 type="varint" offset="8351786" length="6">
16 <unsigned>1634136035360</unsigned>
17 <signed>1634136035360</signed>
18 <hex>17c7a191020</hex>
19 <timestamp format="unixmillisecond">2021-10-13T14:40:35.36Z</timestamp>
20 </f3>
21 <f4 type="array" offset="8351790" length="9582">
22 <plist version="1.0" offset="8351790" length="9582">
23 <dict>
24 <key offset="8351816" length="8">$version</key>
25 <real timestamp="2020-09-18T07:00:33.212011Z" format="cocoa" offset="8351849" length="8">622105233.212011</real>
26 </dict>
27 </plist>
28 </f4>
29 </data>
30 </dict>
31 </dict>
32 </plist>
33 </f1>
34 <f5 type="fixed64" offset="8327396" length="8">
35 <unsigned>4744642132057505105</unsigned>
36 <signed>4744642132057505105</signed>
37 <hex>41d85ae183a3bd51</hex>
38 <float>1634436622.55843</float>
39 <timestamp format="unix">2021-10-17T02:10:22.55843Z</timestamp>
40 </f5>
41 </record>
42 </segb>
