# Plaso iOS related event formatters.
---
type: 'conditional'
data_type: 'ios:accounts:entry'
message:
- 'Account Type: {account_type}'
- 'Username: {username}'
- 'Identifier: {identifier}'
- 'Owning Bundle Identifier: {owning_bundle_identifier}'
short_message:
- 'Account Type: {account_type}'
- 'Username: {username}'
short_source: 'SQLITE'
source: 'iOS accounts database'
---
type: 'conditional'
data_type: 'ios:app_privacy:access'
message:
- 'Accessor Identifier: {accessor_identifier}'
- 'Accessor Identifier Type: {accessor_identifier_type}'
- 'Resource Category: {resource_category}'
- 'Resource Identifier: {resource_identifier}'
short_message:
- 'Accessor Identifier: {accessor_identifier}'
- 'Resource Category: {resource_category}'
short_source: 'LOG'
source: 'iOS application privacy report'
---
type: 'conditional'
data_type: 'ios:app_privacy:network'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Domain: {domain}'
short_message:
- 'Bundle Identifier: {bundle_identifier}'
short_source: 'LOG'
source: 'iOS application privacy report'
---
type: 'conditional'
data_type: 'ios:carplay:history:entry'
message:
- 'Application identifier: {application_identifier}'
short_message:
- 'Application identifier: {application_identifier}'
short_source: 'PLIST'
source: 'Apple iOS Car Play application plist'
---
type: 'conditional'
data_type: 'ios:datausage:event'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Process Name: {process_name}'
- 'WiFi In: {wifi_in}'
- 'WiFi Out: {wifi_out}'
- 'Wireless Wan In: {wireless_wan_in}'
- 'Wireless Wan Out: {wireless_wan_out}'
short_message:
- 'Process Name: {process_name}'
short_source: 'HISTORY'
source: 'iOS data usage database'
---
type: 'conditional'
data_type: 'ios:discord:message'
message:
- 'User Identifier: {user_identifier}'
- 'Username: {username}'
- 'Message: {content}'
- 'Attachment Name: {attachment_name}'
- 'Attachment Size: {attachment_size}'
- 'Attachment type: {attachment_type}'
- 'Attachment URL: {attachment_proxy_url}'
- 'Channel Identifier: {channel_identifier}'
short_message:
- 'Username: {username}'
- 'Message: {content}'
short_source: 'Discord iOS'
source: 'Discord iOS Messages'
---
type: 'conditional'
data_type: 'ios:idstatuscache:lookup'
message:
- 'Process Name: {process_name}'
- 'Apple Identifier: {apple_identifier}'
short_message:
- 'Apple Identifier: {apple_identifier}'
short_source: 'PLIST'
source: 'Apple iOS identity services status cache plist'
---
type: 'conditional'
data_type: 'ios:imohdchat:message'
enumeration_helpers:
- input_attribute: 'status'
  output_attribute: 'status_string'
  default_value: 'UNKNOWN'
  values:
    0: 'Received'
    1: 'Sent'
message:
- 'Sender Name: {alias}'
- 'Message: {text}'
- 'Status: {status_string}'
short_message:
- 'Sender Name: {alias}'
- 'Message: {text}'
- 'Status: {status_string}'
short_source: 'IMO HD Chat message'
source: 'IMO HD Chat Message SQLite database'
---
type: 'conditional'
data_type: 'ios:kik:messaging'
enumeration_helpers:
- input_attribute: 'message_status'
  output_attribute: 'message_status'
  default_value: 'UNKNOWN'
  values:
    0: 'unread'
    2: 'message not sent'
    6: 'sent to Kik server'
    14: 'delivered '
    16: 'message read'
    30: 'read after immediate delivery'
    38: 'not a member of the group'
    66: 'delay in reaching Kik server'
    70: 'push notification sent'
    78: 'delivered after offline'
    94: 'read after offline'
- input_attribute: 'message_type'
  output_attribute: 'message_type'
  default_value: 'UNKNOWN'
  values:
    1: 'received'
    2: 'sent'
    3: 'message to group admin'
    4: 'message to group'
message:
- 'Username: {username}'
- 'Displayname: {displayname}'
- 'Status: {message_status}'
- 'Type: {message_type}'
- 'Message: {body}'
short_message:
- '{body}'
short_source: 'Kik iOS'
source: 'Kik iOS messages'
---
type: 'conditional'
data_type: 'ios:instagram:message'
message:
- 'Sender Identifier: {sender_identifier}'
- 'Username: {username}'
- 'Message: {message}'
- 'Video Chat Identifier: {video_chat_call_identifier}'
- 'Video Chat Title: {video_chat_title}'
- 'Shared Media Identifier: {shared_media_identifier}'
- 'Shared Media URL: {shared_media_url}'
short_message:
- 'Username: {username}'
- 'Message: {message}'
short_source: 'Instagram iOS'
source: 'Instagram iOS threads'
---
type: 'conditional'
data_type: 'ios:lockdownd_log:entry'
message:
- 'Process identifer: {process_identifier}'
- 'Body: {body}'
short_message:
- 'Body: {body}'
short_source: 'LOG'
source: 'iOS lockdown daemon log'
---
type: 'conditional'
data_type: 'ios:mobile_backup:entry'
message:
- 'Activity description: {activity_description}'
short_message:
- 'Activity description: {activity_description}'
short_source: 'PLIST'
source: 'Apple iOS Mobile Backup application plist'
---
type: 'conditional'
data_type: 'ios:mobile_backup:state'
message:
- 'Description: {description}'
short_message:
- 'Description: {description}'
short_source: 'PLIST'
source: 'Apple iOS Mobile Backup application plist'
---
type: 'conditional'
data_type: 'ios:netusage:route'
enumeration_helpers:
- input_attribute: 'network_type'
  output_attribute: 'network_type'
  default_value: 'UNKNOWN'
  values:
    1: 'wifi'
    2: 'cellular'
message:
- 'Bytes In: {bytes_in}'
- 'Bytes Out: {bytes_out}'
- 'Network Identifier: {network_identifier}'
- 'Network Signature: {network_signature}'
- 'Network Type: {network_type}'
short_message:
- 'Network Identifier: {network_identifier}'
- 'Network Type: {network_type}'
short_source: 'HISTORY'
source: 'iOS netusage.sqlite database'
---
type: 'conditional'
data_type: 'ios:netusage:process'
message:
- 'Process Name: {process_name}'
- 'WiFi In: {wifi_in}'
- 'WiFi Out: {wifi_out}'
- 'Wired In: {wired_in}'
- 'Wired Out: {wired_out}'
- 'Wireless Wan In: {wireless_wan_in}'
- 'Wireless Wan Out: {wireless_wan_out}'
short_message:
- 'Process Name: {process_name}'
short_source: 'HISTORY'
source: 'iOS netusage.sqlite database'
---
type: 'conditional'
data_type: 'ios:notes:note'
message:
- 'Title: {title}'
- 'Content: {snippet}'
short_message:
- 'Title: {title}'
short_source: 'SQLITE'
source: 'iOS notes database'
---
type: 'conditional'
data_type: 'ios:powerlog:application_usage'
message:
- 'Application: {bundle_identifier}'
- 'Background Time: {background_time}'
- 'On Screen Time: {screen_on_time}'
short_message:
- 'Application: {bundle_identifier}'
short_source: 'HISTORY'
source: 'iOS powerlog database'
---
type: 'conditional'
data_type: 'ios:screentime:event'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Device Identifier: {device_identifier}'
- 'Device Name: {device_name}'
- 'Domain: {domain}'
- 'Total Time: {total_time}'
- 'User Family Name: {user_family_name}'
- 'User Given Name: {user_given_name}'
short_message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Domain: {domain}'
short_source: 'HISTORY'
source: 'iOS Screen Time database'
---
type: 'conditional'
data_type: 'ios:sim:info'
message:
- 'Phone number: {phone_number}'
- 'SIM Type: {sim_type}'
- 'Cell broadcast version: {cell_broadcast_version}'
- 'Label identifier: {label_identifier}'
short_message:
- 'Phone number: {phone_number}'
short_source: 'PLIST'
source: 'iOS SIM Info'
---
type: 'conditional'
data_type: 'ios:sysdiagnose:logd:line'
message:
- 'Logger: {logger}'
- 'Body: {body}'
short_message:
- 'Body: {body}'
short_source: 'LOG'
source: 'iOS sysdiagnose log'
---
type: 'conditional'
data_type: 'ios:sysdiag_log:entry'
message:
- 'Originating call: {originating_call}'
- 'Body: {body}'
short_message:
- 'Body: {body}'
short_source: 'LOG'
source: 'iOS sysdiag log'
---
type: 'conditional'
data_type: 'ios:twitter:contact'
enumeration_helpers:
- input_attribute: 'following'
  output_attribute: 'following'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
message:
- 'Screen name: {screen_name}'
- 'Profile picture URL: {profile_url}'
- 'Name: {name}'
- 'Location: {location}'
- 'Description: {description}'
- 'URL: {url}'
- 'Following: {following}'
- 'Number of followers: {followers_count}'
- 'Number of following: {following_count}'
short_message:
- 'Screen name: {screen_name}'
- 'Description: {description}'
- 'URL: {url}'
short_source: 'Twitter iOS'
source: 'Twitter iOS Contacts'
---
type: 'conditional'
data_type: 'ios:twitter:status'
enumeration_helpers:
- input_attribute: 'favorited'
  output_attribute: 'favorited'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
message:
- 'Name: {name}'
- 'User Id: {user_identifier}'
- 'Message: {text}'
- 'Favorite: {favorited}'
- 'Retweet Count: {retweet_count}'
- 'Favorite Count: {favorite_count}'
short_message:
- 'Name: {name}'
- 'Message: {text}'
short_source: 'Twitter iOS'
source: 'Twitter iOS Status'
---
type: 'conditional'
data_type: 'ios:wifi:known_networks:entry'
message:
- 'SSID: {ssid}'
- 'BSSID: {bssid}'
- 'Channel: {channel}'
short_message:
- 'SSID: {ssid}'
short_source: 'PLIST'
source: 'Apple iOS WiFi Known Networks plist file'
