TCC.db
Definition
Transparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, photos, contacts, location, full disk access and so on, with timestamps. Forensic gold for proving app capability.
- Location
- /var/mobile/Library/TCC/TCC.db (iOS)
- Tracks permissions for
- Camera, microphone, photos, contacts, location, full disk access and others
- Data recorded
- Which app received which permission and when (timestamped)
Common questions
What is TCC.db used for in digital forensics?+
TCC.db records which apps a user granted access to sensitive phone features like the camera, microphone, contacts, location, and photos. Each permission grant is timestamped, so you can see when an app was first allowed to use those features. This is forensic gold because it proves capability, showing whether an app could actually access a user's camera or location data.
Where do I find TCC.db on an iOS device?+
The database is located at `/var/mobile/Library/TCC/TCC.db`. You'll need forensic imaging or device access to extract it for analysis.
What does TCC stand for?+
TCC stands for Transparency, Consent, and Control. It's Apple's system for tracking which apps have been explicitly permitted to access sensitive device features.
Related terms
- Advanced Data Protection (ADP)
- Apple's opt-in feature since iOS 16.2 (December 2022 in US, global by iOS 16.3) that extends end-to-end encryption to iCloud Backup, iCloud...
- Android Auto Backup
- The Android 6.0+ mechanism that uploads app data to the user's Google Drive automatically (up to 25 MB per app), alongside SMS,...
- APK / IPA
- Android Package and iOS App Store package, the installable bundles for the two platforms. APK is a ZIP containing AndroidManifest.xml, classes.dex and...
- ART
- Android Runtime, the AOT-compiling successor to the Dalvik virtual machine since Android 5.0 Lollipop. Apps compile to OAT files on install for...
- BNSS Section 91
- Bharatiya Nagarik Suraksha Sanhita 2023 Section 91 (successor to CrPC 1973 Section 91) lets a court or officer in charge of a...
- FBE
- File-Based Encryption, the per-file key scheme that replaced Full-Disk Encryption (FDE) from Android 7.0 Nougat onward. Splits files into Credential Encrypted (CE)...
- iCloud Backup
- A daily encrypted snapshot of an iPhone or iPad stored in Apple's cloud. Includes app data the developer marks for backup, device...
- MLAT
- Mutual Legal Assistance Treaty. The formal mechanism for cross-border evidence requests. India has bilateral MLATs with over 40 countries including the US,...
- OAuth Token Acquisition
- Cloud-extraction technique where a tool authenticates to the provider using the user's account credentials or a refresh token extracted from the phone,...
- Secure Enclave
- The dedicated security coprocessor on iPhone 5s and later, running a separate microkernel and holding the per-class encryption keys, the passcode verifier...
- WAL
- Write-Ahead Log, the SQLite journaling mode that writes new pages to a sibling .db-wal file before checkpointing them into the main database....
Explained in these topics
- Mobile Cloud and Backup Forensics: iCloud and Google DriveTransparency, Consent and Control database at /var/mobile/Library/TCC/TCC.db on iOS. Records which apps the user has granted access to camera, microphone, phot...
- Mobile Operating Systems: Android, iOS, SQLite and App ForensicsTransparency, Consent, Control database on iOS, at /var/mobile/Library/TCC/TCC.db. Records which app received which permission (microphone, camera, contacts, l...