PIP (XML and plist parser) – SET UP FILE ONLY

pip-logo

Free!

A software tool which allows digital investigators to present complex data from XML files quickly and efficiently. The tool also parses data from Apple’s plist file format, both in XML and binary.

BUY

The sale of PIP is only on application. If you would like more information please contact pip@cclgroupltd.com or call 01789 261200.

DOWNLOAD

The PIP set up file is available for download here, however this will only work with a valid licence. Please use the contact details above to enquire about purchasing a licence.

SKU: CCL4 Category:

Product Description

PIP streamlines investigations and saves considerable time (Current version v1.1).

XML is a common data storage format which can be found on a wide range of devices and platforms. This includes PCs, phones and sat navs. Although text-based, XML is not usually user-friendly in its raw format. This means that, often, digital investigators have to manually manipulate large amounts of data to find relevant evidence.

PIP solves this problem by parsing data from XML files (using the XPath query language) and presents the results in an easy-to-interpret, user-friendly form.

PIP also supports property list files (“plist”) – used by Apple devices – both in their XML and binary formats.

Flexibility

Included within the tool is a library of XPath queries, with more being researched regularly. Advanced practitioners can also write their own bespoke queries. In addition, PIP allows the quick and easy batch processing of multiple files.

  • Saves a considerable amount of time (for example, PIP processed 263 Facebook application files from an iPhone image in four seconds. It returned 1,800 records including profile views, chat history, photo views with comments and URLs).
  • Ensures costs to investigators are kept to a minimum.
  • Simplifies the presentation of complex data.
  • XML and plist files can contain useful evidence of internet history, web searches, sat nav recent locations, social networking and more.
  • Contains an expanding library of XPath queries.
  • Includes ability to write bespoke queries.
  • Features batch processing capability.
  • Parses XML files (large number of devices use these formats)
  • Parses Apple property list “plist” files
  • Supplied with library of XPath queries (current version available for download - click tab to right)
  • Batch processing allows processing of a number of similar files simultaneously
  • Allows advanced investigators to write bespoke XPath queries
  • Low cost tool, which saves time and therefore operating costs
  • Windows XP, Vista or Windows 7
  • .NET version 4.0
  • Local admin privileges
  • Improved GUI – the layout of the application has been updated to improve work-flow
  • New Tree View – view your data graphically to see, at-a-glance, the structure of your data
  • Automatic XPath Building – Now you can use the Tree View to show PIP the data that you are interested in and PIP will generate the XPath automatically. This even works with Apple's Property List 'dictionary' structures
  • Import/Export Batch Jobs – Set-up a batch job of XPaths for a particular folder structure (iOS Library or Application folders for example) and then export the batch so that you, or anyone else in your lab can re-use it when you next come across the same data
  • Command line version – version 1.1 of PIP comes with the "pipcmd" command-line utility, allowing you to integrate PIP into tool chains and other automated tasks

A regularly-updated library of XPath queries is included within PIP and CCL-Forensics is constantly researching opportunities for new additions to the library; however, for the advanced practitioner, PIP allows bespoke queries to be written for new data types which may be uncovered during the course of an investigation.

New versions of the library can be obtained by contacting CCL on pip@ccl-forensics.com or call 01789 261200.

  • The latest version of the library contains (platform – category – XPath description):
  • Android - Configuration - Installed Packages - Packages.xml
  • Garmin - Location Based and GPS - Garmin Cycle Computer Training Center Database - [year]-[month]-[day]-[hour]-[min]-[sec].tcx
  • Garmin - Location Based and GPS - Saved Locations (Way-points) - current.gpx
  • Linux - IM and VOIP - Kopete Chatlog - [username][date].xml
  • Navman - Location Based and GPS - My Favourite Locations - MyFavouriteLocations.xml
  • Navman - Location Based and GPS - My Multistop Locations - MyMultistopLocations.xml
  • Navman - Location Based and GPS - My Recent Locations - MyRecentLocations
  • Navman - Location Based and GPS - My Route - MyRoute.xml
  • Navman - Location Based and GPS - PropertyBag Files - Various
  • Nokia Series 40 - Browsers - Goto History - gotohistory.dat
  • OSX - Browsers - Safari Bookmarks - Bookmarks.plist
  • OSX - Browsers - Safari Downloads - Downloads.plist
  • OSX - Browsers - Safari History - History.plist
  • OSX - Browsers - Safari Last Session - LastSession.plist
  • OSX - Browsers - Safari Recent Searches - com.apple.Safari.plist
  • OSX - Browsers - Safari Top Sites - TopSites.plist
  • OSX - Configuration - Install History - InstallHistory.plist
  • OSX - Configuration - iPods - com.apple.iPod.plist
  • OSX - Email - Mac Mail Accounts - com.apple.mail.plist
  • OSX - IM and VOIP - Kopete Chatlog - [username][date].xml
  • OSX - Log Files - Install History - InstallHistory.plist
  • Windows - Browsers - Safari Bookmarks - Bookmarks.plist
  • Windows - Browsers - Safari Downloads - Downloads.plist
  • Windows - Browsers - Safari History - History.plist
  • Windows - Browsers - Safari Last Session - LastSession.plist
  • Windows - Browsers - Safari Recent Searches - com.apple.Safari.plist
  • Windows - Browsers - Safari Top Sites - TopSites.plist
  • Windows - IM and VOIP - GaduGadu Contacts - ContactList.xml
  • iOS - Browsers - Cookies - Cookies.plist
  • iOS - Browsers - Google App WebHistory - WebHistory.plist
  • iOS - Browsers - Safari Bookmarks - Bookmarks.plist
  • iOS - Browsers - Safari History - History.plist
  • iOS - Browsers - Safari Recent Searches - RecentSearches.plist
  • iOS - Browsers - Safari Suspend State - SuspendState.plist
  • iOS - Browsers - Skyfire Browser History - History.plist
  • iOS - Configuration - Device Backup Info - Info.plist
  • iOS - Configuration - iPhone Bluetooth Device History - com.apple.MobileBluetooth.devices.plist
  • iOS - Configuration - iPhone WiFi - com.apple.wifi.plist
  • iOS - Email - Application Push Store - [app id].pushstore
  • iOS - Email - Email Notifications - Bulletins
  • iOS - IM and VOIP - Application Push Store - [app id].pushstore
  • iOS - IM and VOIP - Gaydar Message History - conversation.plist
  • iOS - IM and VOIP - IM+ Contacts - implus_cl
  • iOS - IM and VOIP - IM+ Messages - implus_dlgs
  • iOS - IM and VOIP - PingChat Chatlog - CHATS.plist
  • iOS - IM and VOIP - Textie Messages - Plists stored in SQLite database (filename varies)
  • iOS - IM and VOIP - Windows Live Messenger Contacts Highlight Activities - *WN_ContactsHighlightActivities*.cache
  • iOS - IM and VOIP - Windows Live Messenger Recent Activities - *RecentActivities*.cache
  • iOS - Location Based and GPS - Locationd Clients - clients.plist
  • iOS - Location Based and GPS - Maps History - History.plist
  • iOS - Location Based and GPS - Maps History (iOS 4.x) - History.plist
  • iOS - Other - FooCall Details - FooCall.plist
  • iOS - Other - Addison Lee Bookings - BookingHistory.plist
  • iOS - SMS/MMS - Application Push Store - [app id].pushstore
  • iOS - SMS/MMS - SMS Drafts - message.plist
  • iOS - Social Networking - Application Push Store - [app id].pushstore
  • iOS - Social Networking - Facebook Login Preferences - com.facebook.Facebook.plist
  • iOS - Social Networking - Facebook Three20 Checkins (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 History - Various
  • iOS - Social Networking - Facebook Three20 Inbox_Response - Various
  • iOS - Social Networking - Facebook Three20 Message Threads (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 Messages (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 Notification - Various
  • iOS - Social Networking - Facebook Three20 Notifications (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 Phonebook Luckup (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 Photos (FQL_Multiquery_Response) - Various
  • iOS - Social Networking - Facebook Three20 Photos_Response - Various
  • iOS - Social Networking - Facebook Three20 Profile_Response - Various
  • iOS - Social Networking - Facebook Three20 Thread_Response - Various
  • iOS - Social Networking - Gaydar Message History - conversation.plist
  • iOS - Social Networking - MyPad Messages - me_inbox.db
  • iOS - Social Networking - Official Twitter Application: Statuses - Various (Named as a UID)
  • iOS - Social Networking - Twitter (Official) Direct Messages - app.state/app-ipad.state
  • iOS - Social Networking - Twitter (Official) User Name - app.state/app-ipad.state
  • iOS - Utilities - InstinctiveCode Favorites Speed-dial - Favorites.plist
  • iOS - Utilities - Mobile Phone Speed Dial / Favourites - com.apple.mobilephone.speeddial.plist
For information on PIP training please contact pip@ccl-forensics.com.