ddurvaux / APOLLO

Apple Pattern of Life Lazy Output'er

Apple Pattern of Life Lazy Output'er (APOLLO)

• Originally presented as the first ever Objective by the Sea - Mac Security Conference in 2018
• Presentation Slides: From Apple Seeds to Apple Pie
• Presentation Slides: Launching APOLLO: Creating a Simple Tool for Advanced Forensic Analysis

BETA - FOR TESTING PURPOSES ONLY

• This is your warning. I've tested a few modules but there is much more testing to be done.
• Find a bug or a better query, let me know!
• Extra warning on PowerLog modules, timestamps may be in the past and/or future - testing these.
• Many more modules to come!
• Python 3 (omg, finally!)

Dependencies

• SimpleKML - Copy the simplekml directory to the directory where apollo.py is being run from.

Usage

python apollo.py -o {csv, sql} -p {ios, mac, yolo} -v {8,9,10,11,12,yolo} -k <modules directory> <data directory>

Output Options (-o)

• csv - CSV
• sql - SQLite Database

KMZ Output(-k)

• Outputs location coordinates to separate files based on module.

Platform Options (-p)

• ios
• mac [Offical support coming soon!]
• yolo - Just parse whatever. Use for ARTEMIS parsing.

Version Options (-v)

• iOS 8, 9, 10, 11, 12
• yolo - Just parse whatever. Use for ARTEMIS parsing.

Getting Errors? Try This (Windows users, use eqivlent commands)

• Check database permissions - Use chmod to give some databases with "all blank" permissions some sort of permission. (Happens with many types of physical-logical extractions.)
• Check database ownership - Use chown to take ownership of the files.

Thank You!

• Thanks to Sam Alptekin of @sjc_CyberCrimes, script is much, much faster than original.
• Thanks to @AlexisBrignoni for Python 3 support and ARTEMIS!

References

• Knowledge is Power! Using the macOS/iOS knowledgeC.db Database to Determine Precise User and Application Usage
• Knowledge is Power II – A Day in the Life of My iPhone using knowledgeC.db
• On the First Day of APOLLO, My True Love Gave to Me - A Python Script – An Introduction to the Apple Pattern of Life Lazy Output’er (APOLLO) Blog Series
• On the Second Day of APOLLO, My True Love Gave to Me - Holiday Treats and a Trip to the Gym - A Look at iOS Health Data
• On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to Determine Who Has Been Naughty or Nice
• On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to Prove You Listened to “All I Want for Christmas is You” Over and Over Since Before Thanksgiving
• On the Fifth Day of APOLLO, My True Love Gave to Me – A Stocking Full of Random Junk, Some of Which Might be Useful!
• On the Sixth Day of APOLLO, My True Love Gave to Me – Blinky Things with Buttons – Device Status Analysis
• On the Seventh Day of APOLLO, My True Love Gave to Me – A Good Conversation – Analysis of Communications and Data Usage
• On the Eighth Day of APOLLO, My True Love Gave to Me – A Glorious Lightshow – Analysis of Device Connections
• On the Ninth Day of APOLLO, My True Love Gave to Me – A Beautiful Portrait – Analysis of the iOS Interface
• On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map of My Recent Travels – iOS Location Analysis
• On the Eleventh Day of APOLLO, My True Love Gave to Me – An Intriguing Story – Putting it All Together: A Day in the Life of My iPhone using APOLLO
• On the Twelfth Day of APOLLO, My True Love Gave to Me – A To Do List – Twelve Planned Improvements to APOLLO