App Sandbox Container
Definition
An isolated directory assigned to each app on iOS under /var/mobile/Containers/Data/Application/<UUID>/. The container holds all of the app's Documents, Library, and tmp subdirectories. Apps cannot read each other's containers without explicit sharing entitlements, which is both a security feature and a forensic constraint.
- Location
- /var/mobile/Containers/Data/Application/<UUID>/
- Platform
- iOS
- Contents
- App's Documents, Library, and tmp subdirectories
- Isolation
- Not readable by other apps without explicit sharing entitlements
Common questions
Why does an examiner need a full file-system extraction to see app sandbox data, not just a logical backup?+
A standard iTunes-style backup omits many container files by design, so a full or file-system-level extraction is generally needed to reach the complete Documents, Library, and cache contents inside each app's container.
How does the UUID naming of each container affect mapping evidence back to a specific app?+
Because the container folder name is a random identifier rather than the app's name, an examiner has to cross-reference it against the device's application database or property lists to determine which UUID corresponds to which installed app before interpreting its contents.
Related terms
- iOS Keychain
- A hardware-backed secure credential store on iOS devices that holds passwords, authentication tokens, and cryptographic keys. Keychain items are encrypted with keys...
- NAND Flash
- The type of non-volatile memory used in all modern mobile device storage. Data is written to pages grouped into blocks; erasure operates...
- Plist (Property List)
- A structured data format native to Apple operating systems, available in XML and binary variants. iOS uses plist files to store app...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...
- Wear-Leveling
- A flash storage controller behavior that distributes write operations across all available memory cells to prevent premature failure of any single cell....