Type XML PList

<< Details >>

Defined Constant	Type_XML_PList
File Type Value	446
Parent Type	XML
Carve	Yes
Format Details	No
MIME Type	text/xml
Filename Extension	plist

Plist (XML)

Description

Property List XML

Truxton Exploiters

This file type is handled by the following ETLs:

• Expand

Items Produced

Truxton will extract the following from this file type:

• ENTITY_TYPE_APPLE_UDID
• ENTITY_TYPE_DEVICE_NAME
• ENTITY_TYPE_ICCID
• ENTITY_TYPE_IMEI
• ENTITY_TYPE_MEID
• ENTITY_TYPE_PHONE_NUMBER
• ENTITY_TYPE_SERIAL_NUMBER
• URL_TYPE_SAFARI
• Files

Sample

When Truxton adds forensic data to the XML it produces. The offset and length attributes tell you where in the parent file this value comes from. For convenience, Truxton will check real values to see if they are valid timestamps and convert them for you. The highlighted line below demonstrates this human-readable timestamp.

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
 <plist version="1.0" offset="0" length="464">
  <dict>
   <key offset="18" length="8">$objects</key>
   <array offset="0" length="0">
    <array>
     <string offset="0" length="0">$null</string>
     <dict>
      <dict>
       <key offset="75" length="10">NS.objects</key>
       <array offset="0" length="0">
        <array>
         <uid offset="0" length="0">5</uid>
         <uid offset="105" length="1">7</uid>
         <uid offset="107" length="1">8</uid>
        </array>
       </array>
       <key offset="86" length="6">$class</key>
       <uid offset="111" length="1">9</uid>
       <key offset="93" length="7">NS.keys</key>
       <array offset="0" length="0">
        <array>
         <uid offset="0" length="0">2</uid>
         <uid offset="117" length="1">3</uid>
         <uid offset="119" length="1">4</uid>
        </array>
       </array>
      </dict>
     </dict>
     <string offset="62" length="5">ImportedFileSystemAssetsDate</string>
     <string offset="125" length="28">ImportedFileSystemAssets</string>
     <string offset="156" length="24">RebuildCompleteDate</string>
     <dict>
      <dict>
       <key offset="86" length="6">$class</key>
       <uid offset="216" length="1">6</uid>
       <key offset="208" length="7">NS.time</key>
       <real timestamp="2020-09-18T07:00:33.557542Z" format="cocoa" offset="218" length="8">622105233.557542</real>
      </dict>
     </dict>
     <dict>
      <dict>
       <key offset="232" length="8">$classes</key>
       <array offset="0" length="0">
        <array>
         <string offset="0" length="0">NSDate</string>
         <string offset="255" length="6">NSObject</string>
        </array>
       </array>
       <key offset="241" length="10">$classname</key>
       <string offset="255" length="6">NSDate</string>
      </dict>
     </dict>
     <integer offset="183" length="19">1</integer>
     <dict>
      <dict>
       <key offset="86" length="6">$class</key>
       <uid offset="216" length="1">6</uid>
       <key offset="208" length="7">NS.time</key>
       <real timestamp="2020-09-18T07:00:33.212011Z" format="cocoa" offset="280" length="8">622105233.212011</real>
      </dict>
     </dict>
     <dict>
      <dict>
       <key offset="232" length="8">$classes</key>
       <array offset="0" length="0">
        <array>
         <string offset="0" length="0">NSDictionary</string>
         <string offset="297" length="12">NSObject</string>
        </array>
       </array>
       <key offset="241" length="10">$classname</key>
       <string offset="297" length="12">NSDictionary</string>
      </dict>
     </dict>
    </array>
   </array>
   <key offset="27" length="8">$version</key>
   <integer offset="310" length="4">100000</integer>
   <key offset="36" length="9">$archiver</key>
   <string offset="317" length="15">NSKeyedArchiver</string>
   <key offset="46" length="4">$top</key>
   <dict offset="0" length="0">
    <dict>
     <key offset="336" length="4">root</key>
     <uid offset="341" length="1">1</uid>
    </dict>
   </dict>
  </dict>
 </plist>