{"id":20166771,"url":"https://github.com/ahoog42/ios-triage","last_synced_at":"2025-06-20T02:37:13.939Z","repository":{"id":17457161,"uuid":"55205118","full_name":"ahoog42/ios-triage","owner":"ahoog42","description":"incident response tool for iOS devices","archived":false,"fork":false,"pushed_at":"2022-04-27T18:47:30.000Z","size":361,"stargazers_count":49,"open_issues_count":11,"forks_count":7,"subscribers_count":7,"default_branch":"master","last_synced_at":"2025-04-10T01:38:52.721Z","etag":null,"topics":["cli","incident-response","ios","ios-triage","libimobiledevice","nodejs","triage"],"latest_commit_sha":null,"homepage":"","language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ahoog42.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2016-04-01T05:04:53.000Z","updated_at":"2024-08-12T19:22:10.000Z","dependencies_parsed_at":"2022-08-07T08:16:01.608Z","dependency_job_id":null,"html_url":"https://github.com/ahoog42/ios-triage","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/ahoog42/ios-triage","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahoog42%2Fios-triage","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahoog42%2Fios-triage/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahoog42%2Fios-triage/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahoog42%2Fios-triage/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ahoog42","download_url":"https://codeload.github.com/ahoog42/ios-triage/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ahoog42%2Fios-triage/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":260867677,"owners_count":23074913,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","incident-response","ios","ios-triage","libimobiledevice","nodejs","triage"],"created_at":"2024-11-14T00:46:04.310Z","updated_at":"2025-06-20T02:37:08.922Z","avatar_url":"https://github.com/ahoog42.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ios-triage [![Build Status](https://travis-ci.org/ahoog42/ios-triage.svg?branch=master)](https://travis-ci.org/ahoog42/ios-triage) [![Dependencies](https://img.shields.io/david/ahoog42/ios-triage.svg?style=flat-square)](https://david-dm.org/ahoog42/ios-triage)\nNode.js cli for iOS incident response. Program will extract, process and report (including diffs) on iOS device and app telemetry.\n\n## Installation\nCurrently working on OSX and Linux. This program depends on the excellent [libimobiledevice](http://www.libimobiledevice.org/) project.\n\n### OS specific steps\n\n#### OSX\nMake sure brew is installed. Then, install libimobiledevice from `--HEAD` otherwise I had problems connecting to lockdownd (as of Dec 2016):\n\n```\nbrew install --HEAD libimobiledevice\nbrew install --HEAD ideviceinstaller\n```\n\n#### Linux (Ubuntu)\nThese instructions are based on a fresh Ubuntu 16.04 LTS install.\n\n```\nsudo apt-get install ideviceinstaller libimobiledevice-utils build-essential libssl-dev git\n```\n\n### Install node ([nvm](https://github.com/creationix/nvm))\nRemaining steps are for both OSX and Linux.\n\n```\ncurl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.1/install.sh | bash\n\nnvm install node\nnvm use node\n```\n\n### Clone ios-triage, install and link\n\n```\ngit clone https://github.com/ahoog42/ios-triage.git\n\ncd ios-triage\nnpm install\nnpm link\n```\n\n## Usage\nWhen you run ios-triage, there are three primary steps:\n\n1. extract\n1. process\n1. report\n\nEach command has various options. You can run `ios-triage \u003ccmd\u003e --help` for additional instructions. Below are examples of the most common options and workflow.\n\n### extract\nios-triage will automatically create a directory with the device UDID and then a timestamp (epoch in ms) for each extraction. This allows you to collect telemetry over time and perform diffs. A good example would be if an individual is travelling overseas and might be a targeted. You could image the device prior to the trip and after to then compare the available device telemetry.\n\n**Note:** you must connect the iDevice to your host and trust it from the device. Then, run the following:\n\n`ios-triage extract .`\n\n### process\nTo process the device extraction, you have to point ios-triage at the top-level extraction directory structure is \u003cudid\u003e/\u003cepoch\u003e. An example would be:\n\n`$ ios-triage process dc9363415e5fbf18ea8277986f3b693cf01827aa/1486829681725/`\n\n### report\nTo produce an analyst report, you simple direct ios-triage at the top-level extraction directory:\n\n`$ ios-triage report dc9363415e5fbf18ea8277986f3b693cf01827aa/1486829681725/`\n\n#### diffs\nIf you have two extractions that you've already processed, you can include a second directory to the report command which will then populate the Diff page with a comparision of what has changed between the two extractions:\n\n```\ncd dc9363415e5fbf18ea8277986f3b693cf01827aa\nios-triage report 1485283295826/ 1486829681725/ \n```\n\n## Future work\nThere's quite a bit to do in the future. Also note that I used this project to teach myself nodejs so there's quite a bit of cruft in the code. \n\n* Move to a database backend\n* Create docker container to remove dependencies and perhaps run on Windows\n* Download iOS apps via iTunes and perform additional static analysis\n* Integrate third-party data sources\n* Allow upload and then comparision of non-PII data to crowsource our efforts\n\n## Contribute\nIf you'd like to contribute to ios-triage, there are many ways to help:\n\n* Run the tool, file big reports, suggestions, etc.\n* Share non-PII data for comparitive analysis\n* UX help!!\n* Development of new features\n* Documentation\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fahoog42%2Fios-triage","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fahoog42%2Fios-triage","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fahoog42%2Fios-triage/lists"}