Pip

pip-logo

A software tool which allows digital investigators to present complex data from XML files quickly and efficiently. The tool also parses data from Apple’s plist file format, both in XML and binary.

The sale of PIP is only on application. Please contact  or call 01789 261200 to enquire about licence fees.

Product Description

Product Description

PIP streamlines investigations and saves considerable time (Current version v1.1).

XML is a common data storage format which can be found on a wide range of devices and platforms. This includes PCs, phones and sat navs. Although text-based, XML is not usually user-friendly in its raw format. This means that, often, digital investigators have to manually manipulate large amounts of data to find relevant evidence.

PIP solves this problem by parsing data from XML files (using the XPath query language) and presents the results in an easy-to-interpret, user-friendly form.

PIP also supports property list files (“plist”) – used by Apple devices – both in their XML and binary formats.

Flexibility

Included within the tool is a library of XPath queries, with more being researched regularly. Advanced practitioners can also write their own bespoke queries. In addition, PIP allows the quick and easy batch processing of multiple files.

Why use PIP?

Why use PIP?

  • Saves a considerable amount of time (for example, PIP processed 263 Facebook application files from an iPhone image in four seconds. It returned 1,800 records including profile views, chat history, photo views with comments and URLs).
  • Ensures costs to investigators are kept to a minimum.
  • Simplifies the presentation of complex data.
  • XML and plist files can contain useful evidence of internet history, web searches, sat nav recent locations, social networking and more.
  • Contains an expanding library of XPath queries.
  • Includes ability to write bespoke queries.
  • Features batch processing capability.

Features

Features

  • Parses XML files (large number of devices use these formats)
  • Parses Apple property list “plist” files
  • Supplied with library of XPath queries (current version available for download – click tab to right)
  • Batch processing allows processing of a number of similar files simultaneously
  • Allows advanced investigators to write bespoke XPath queries
  • Low cost tool, which saves time and therefore operating costs

System Requirements

System Requirements

  • Windows XP, Vista or Windows 7
  • .NET version 4.0
  • Local admin privileges

Training

Training

Training is provided at CCL-Forensics’ laboratory in Warwickshire, UK. On-site training can be provided depending on attendee numbers. Please contact for more information. Duration of course: 1 day.

What's New

What’s New

  • Improved GUI – the layout of the application has been updated to improve work-flow
  • New Tree View – view your data graphically to see, at-a-glance, the structure of your data
  • Automatic XPath Building – Now you can use the Tree View to show PIP the data that you are interested in and PIP will generate the XPath automatically. This even works with Apple’s Property List ‘dictionary’ structures
  • Import/Export Batch Jobs – Set-up a batch job of XPaths for a particular folder structure (iOS Library or Application folders for example) and then export the batch so that you, or anyone else in your lab can re-use it when you next come across the same data
  • Command line version – version 1.1 of PIP comes with the “pipcmd” command-line utility, allowing you to integrate PIP into tool chains and other automated tasks

Videos

Videos

XPath Library

XPath Library

A regularly-updated library of XPath queries is included within PIP and CCL-Forensics is constantly researching opportunities for new additions to the library; however, for the advanced practitioner, PIP allows bespoke queries to be written for new data types which may be uncovered during the course of an investigation.

New versions of the library can be obtained by contacting CCL on or call 01789 261200.

  • The latest version of the library contains (platform – category – XPath description):
  • Android – Configuration – Installed Packages – Packages.xml
  • Garmin – Location Based and GPS – Garmin Cycle Computer Training Center Database – [year]-[month]-[day]-[hour]-[min]-[sec].tcx
  • Garmin – Location Based and GPS – Saved Locations (Way-points) – current.gpx
  • Linux – IM and VOIP – Kopete Chatlog – [username][date].xml
  • Navman – Location Based and GPS – My Favourite Locations – MyFavouriteLocations.xml
  • Navman – Location Based and GPS – My Multistop Locations – MyMultistopLocations.xml
  • Navman – Location Based and GPS – My Recent Locations – MyRecentLocations
  • Navman – Location Based and GPS – My Route – MyRoute.xml
  • Navman – Location Based and GPS – PropertyBag Files – Various
  • Nokia Series 40 – Browsers – Goto History – gotohistory.dat
  • OSX – Browsers – Safari Bookmarks – Bookmarks.plist
  • OSX – Browsers – Safari Downloads – Downloads.plist
  • OSX – Browsers – Safari History – History.plist
  • OSX – Browsers – Safari Last Session – LastSession.plist
  • OSX – Browsers – Safari Recent Searches – com.apple.Safari.plist
  • OSX – Browsers – Safari Top Sites – TopSites.plist
  • OSX – Configuration – Install History – InstallHistory.plist
  • OSX – Configuration – iPods – com.apple.iPod.plist
  • OSX – Email – Mac Mail Accounts – com.apple.mail.plist
  • OSX – IM and VOIP – Kopete Chatlog – [username][date].xml
  • OSX – Log Files – Install History – InstallHistory.plist
  • Windows – Browsers – Safari Bookmarks – Bookmarks.plist
  • Windows – Browsers – Safari Downloads – Downloads.plist
  • Windows – Browsers – Safari History – History.plist
  • Windows – Browsers – Safari Last Session – LastSession.plist
  • Windows – Browsers – Safari Recent Searches – com.apple.Safari.plist
  • Windows – Browsers – Safari Top Sites – TopSites.plist
  • Windows – IM and VOIP – GaduGadu Contacts – ContactList.xml
  • iOS – Browsers – Cookies – Cookies.plist
  • iOS – Browsers – Google App WebHistory – WebHistory.plist
  • iOS – Browsers – Safari Bookmarks – Bookmarks.plist
  • iOS – Browsers – Safari History – History.plist
  • iOS – Browsers – Safari Recent Searches – RecentSearches.plist
  • iOS – Browsers – Safari Suspend State – SuspendState.plist
  • iOS – Browsers – Skyfire Browser History – History.plist
  • iOS – Configuration – Device Backup Info – Info.plist
  • iOS – Configuration – iPhone Bluetooth Device History – com.apple.MobileBluetooth.devices.plist
  • iOS – Configuration – iPhone WiFi – com.apple.wifi.plist
  • iOS – Email – Application Push Store – [app id].pushstore
  • iOS – Email – Email Notifications – Bulletins
  • iOS – IM and VOIP – Application Push Store – [app id].pushstore
  • iOS – IM and VOIP – Gaydar Message History – conversation.plist
  • iOS – IM and VOIP – IM+ Contacts – implus_cl
  • iOS – IM and VOIP – IM+ Messages – implus_dlgs
  • iOS – IM and VOIP – PingChat Chatlog – CHATS.plist
  • iOS – IM and VOIP – Textie Messages – Plists stored in SQLite database (filename varies)
  • iOS – IM and VOIP – Windows Live Messenger Contacts Highlight Activities – *WN_ContactsHighlightActivities*.cache
  • iOS – IM and VOIP – Windows Live Messenger Recent Activities – *RecentActivities*.cache
  • iOS – Location Based and GPS – Locationd Clients – clients.plist
  • iOS – Location Based and GPS – Maps History – History.plist
  • iOS – Location Based and GPS – Maps History (iOS 4.x) – History.plist
  • iOS – Other – FooCall Details – FooCall.plist
  • iOS – Other – Addison Lee Bookings – BookingHistory.plist
  • iOS – SMS/MMS – Application Push Store – [app id].pushstore
  • iOS – SMS/MMS – SMS Drafts – message.plist
  • iOS – Social Networking – Application Push Store – [app id].pushstore
  • iOS – Social Networking – Facebook Login Preferences – com.facebook.Facebook.plist
  • iOS – Social Networking – Facebook Three20 Checkins (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 History – Various
  • iOS – Social Networking – Facebook Three20 Inbox_Response – Various
  • iOS – Social Networking – Facebook Three20 Message Threads (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 Messages (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 Notification – Various
  • iOS – Social Networking – Facebook Three20 Notifications (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 Phonebook Luckup (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 Photos (FQL_Multiquery_Response) – Various
  • iOS – Social Networking – Facebook Three20 Photos_Response – Various
  • iOS – Social Networking – Facebook Three20 Profile_Response – Various
  • iOS – Social Networking – Facebook Three20 Thread_Response – Various
  • iOS – Social Networking – Gaydar Message History – conversation.plist
  • iOS – Social Networking – MyPad Messages – me_inbox.db
  • iOS – Social Networking – Official Twitter Application: Statuses – Various (Named as a UID)
  • iOS – Social Networking – Twitter (Official) Direct Messages – app.state/app-ipad.state
  • iOS – Social Networking – Twitter (Official) User Name – app.state/app-ipad.state
  • iOS – Utilities – InstinctiveCode Favorites Speed-dial – Favorites.plist
  • iOS – Utilities – Mobile Phone Speed Dial / Favourites – com.apple.mobilephone.speeddial.plist

Training

Training

For information on PIP training please contact .

Your Name (required)

Your Email (required)

Subject

Your Message

×

Your Name (required)

Your Email (required)

Subject

Your Message

×

Case Studies
Case Study – Nuix and ICIJ
Case Study – Nuix and Abbyy
Case Study – Nuix and Bitsec
Case Study – Nuix and Celerity
Case Study – Nuix and Gulfstream
Case Study – Nuix and EDRM
Case Study – Nuix and Guernsey Police
Case Study – Nuix – Financial Institution Saves Two Years and Millions of Dollars

White Papers
White Paper – Nuix and NetClean
White Paper – Digital Investigations

×

Your Name (required)

Your Email (required)

Subject

Your Message

×
Interested in Buying - Epilog

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Training - Epilog

First Name (required)

Last Name (required)

Company (required)

Phone Number (required)

Your Email (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country(required)

Product

Quantity(required)

Interested in any other products?

×
Interested in Buying - Dunk

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Encase V7

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Nuix

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - PIP

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Rubus

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Signal

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Clearwell

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Tracks Inspector

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - X1 Social Discovery

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Interested in Buying - Ribbon

First Name (required)

Last Name (required)

Company (required)

Your Email (required)

Phone Number (required)

Address (required)

Town/City (required)

Post/Zip Code(required)

Country (required)

 

Product

Quantity(required)

 

Interested in any other products?

Thank you for your enquiry, all applications for the purchase of CCL software are evaluated in accordance with the company’s ethics policy and current Government guidelines on trade embargoes and sanctions.

You will receive a communication from our Customer Service department shortly.

Please leave this field empty.

×
Contact us

By continuing to use the site, you agree to the use of cookies. more information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings or you click "Accept" below then you are consenting to this.

Close