# Plaso iOS related event formatters.
---
type: 'conditional'
data_type: 'ios:accounts:entry'
message:
- 'Account Type: {account_type}'
- 'Username: {username}'
- 'Identifier: {identifier}'
- 'Owning Bundle Identifier: {owning_bundle_identifier}'
short_message:
- 'Account Type: {account_type}'
- 'Username: {username}'
short_source: 'SQLITE'
source: 'iOS accounts database'
---
type: 'conditional'
data_type: 'ios:app_privacy:access'
message:
- 'Accessor Identifier: {accessor_identifier}'
- 'Accessor Identifier Type: {accessor_identifier_type}'
- 'Resource Category: {resource_category}'
- 'Resource Identifier: {resource_identifier}'
short_message:
- 'Accessor Identifier: {accessor_identifier}'
- 'Resource Category: {resource_category}'
short_source: 'LOG'
source: 'iOS application privacy report'
---
type: 'conditional'
data_type: 'ios:app_privacy:network'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Domain: {domain}'
short_message:
- 'Bundle Identifier: {bundle_identifier}'
short_source: 'LOG'
source: 'iOS application privacy report'
---
type: 'conditional'
data_type: 'ios:carplay:history:entry'
message:
- 'Application identifier: {application_identifier}'
short_message:
- 'Application identifier: {application_identifier}'
short_source: 'PLIST'
source: 'Apple iOS Car Play application plist'
---
type: 'conditional'
data_type: 'ios:datausage:event'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Process Name: {process_name}'
- 'WiFi In: {wifi_in}'
- 'WiFi Out: {wifi_out}'
- 'Wireless Wan In: {wireless_wan_in}'
- 'Wireless Wan Out: {wireless_wan_out}'
short_message:
- 'Process Name: {process_name}'
short_source: 'HISTORY'
source: 'iOS data usage database'
---
type: 'conditional'
data_type: 'ios:discord:message'
message:
- 'User Identifier: {user_identifier}'
- 'Username: {username}'
- 'Message: {content}'
- 'Attachment Name: {attachment_name}'
- 'Attachment Size: {attachment_size}'
- 'Attachment type: {attachment_type}'
- 'Attachment URL: {attachment_proxy_url}'
- 'Channel Identifier: {channel_identifier}'
short_message:
- 'Username: {username}'
- 'Message: {content}'
short_source: 'Discord iOS'
source: 'Discord iOS Messages'
---
type: 'conditional'
data_type: 'ios:health:achievement'
message:
- 'Template Name: {template_unique_name}'
- 'Earned Date: {earned_date}'
- 'Value: {value_in_canonical_unit} {value_canonical_unit}'
- 'Creator Device ID: {creator_device}'
- 'Synchronization Provenance: {synchronization_provenance}'
short_message:
- 'Achievement: {template_unique_name}'
- 'Value: {value_in_canonical_unit}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:all_watch_sleep'
enumeration_helpers:
- input_attribute: 'sleep_state_code'
  output_attribute: 'sleep_state_string'
  default_value: 'UNKNOWN'
  values:
    0: 'In Bed'
    1: 'Asleep'
message:
- 'Sleep Status: {sleep_state_string}'
short_message:
- 'Sleep Status: {sleep_state_string}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:headphone_audio_levels'
message:
- 'Sound Level: {decibels} dB'
- 'Duration: {total_time_duration}'
- 'Bundle identifier: {bundle_identifier}'
- 'Device: {device_name} ({device_model})'
- 'Manufacturer: {device_manufacturer}'
short_message:
- '{decibels} dB via {device_name} for {total_time_duration}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:heart_rate'
enumeration_helpers:
- input_attribute: 'context'
  output_attribute: 'context_string'
  default_value: 'UNKNOWN'
  values:
    1.0: 'Background'
    2.0: 'Streaming'
    3.0: 'Sedentary'
    4.0: 'Walking'
    5.0: 'Breathe'
    6.0: 'Workout'
    8.0: 'Background'
    9.0: 'ECG'
    10.0: 'Blood Oxygen Saturation'
message:
- 'Heart Rate: {bpm} BPM'
- 'Context: {context_string}'
- 'Device: {device_name} ({hardware})'
- 'Source: {source_name} (v{software_version})'
- 'Time Zone: {time_zone}'
short_message:
- '{bpm} BPM ({context})'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:height'
message:
- 'Height: {height_m} meters'
short_message:
- 'Height: {height} m'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:resting_heart_rate'
message:
- 'Resting Heart Rate: {resting_heart_rate} BPM'
- 'Source: {source}'
- 'Hardware: {hardware}'
short_message:
- 'Resting HR: {resting_heart_rate} BPM'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:source_devices'
message:
- 'Device Name: {device_name}'
- 'Manufacturer: {manufacturer}'
- 'Model: {model}'
- 'Hardware Version: {hardware}'
- 'Software/Firmware: {software} / {firmware}'
- 'Local Identifier: {device_local_identifier}'
- 'Synchronization Provenance: {synchronization_provenance}'
short_message:
- 'Source Device: {device_name} ({model})'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:steps'
message:
- 'Steps: {number_of_steps}'
- 'Device: {device}'
- 'Duration: {duration} seconds'
short_message:
- '{number_of_steps} steps via {device}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:weight'
message:
- 'Weight: {weight:.2f} kg'
short_message:
- 'Weight: {weight:.2f} kg'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:workouts'
enumeration_helpers:
- input_attribute: 'activity_type'
  output_attribute: 'activity_label'
  default_value: 'OTHER'
  values:
    1: "AMERICAN FOOTBALL"
    2: "ARCHERY"
    3: "AUSTRALIAN FOOTBALL"
    4: "BADMINTON"
    5: "BASEBALL"
    6: "BASKETBALL"
    7: "BOWLING"
    8: "BOXING"
    9: "CLIMBING"
    10: "CRICKET"
    11: "CROSS TRAINING"
    12: "CURLING"
    13: "CYCLING"
    16: "ELLIPTICAL"
    17: "EQUESTRIAN SPORTS"
    18: "FENCING"
    19: "FISHING"
    20: "FUNCTION STRENGTH TRAINING"
    21: "GOLF"
    22: "GYMNASTICS"
    23: "HANDBALL"
    24: "HIKING"
    25: "HOCKEY"
    26: "HUNTING"
    27: "LACROSS"
    28: "MARTIAL ARTS"
    29: "MIND AND BODY"
    31: "PADDLE SPORTS"
    32: "PLAY"
    33: "PREPARATION AND RECOVERY"
    34: "RACQUETBALL"
    35: "ROWING"
    36: "RUGBY"
    37: "RUNNING"
    38: "SAILING"
    39: "SKATING SPORTS"
    40: "SNOW SPORTS"
    41: "SOCCER"
    42: "SOFTBALL"
    43: "SQUASH"
    44: "STAIRSTEPPER"
    45: "SURFING SPORTS"
    46: "SWIMMING"
    47: "TABLE TENNIS"
    48: "TENNIS"
    49: "TRACK AND FIELD"
    50: "TRADITIONAL STRENGTH TRAINING"
    51: "VOLLEYBALL"
    52: "WALKING"
    53: "WATER FITNESS"
    54: "WATER POLO"
    55: "WATER SPORTS"
    56: "WRESTLING"
    57: "YOGA"
    58: "BARRE"
    59: "CORE TRAINING"
    60: "CROSS COUNTRY SKIING"
    61: "DOWNHILL SKIING"
    62: "FLEXIBILITY"
    63: "HIGH INTENSITY INTERVAL TRAINING (HIIT)"
    64: "JUMP ROPE"
    65: "KICKBOXING"
    66: "PILATES"
    67: "SNOWBOARDING"
    68: "STAIRS"
    69: "STEP TRAINING"
    70: "WHEELCHAIR WALK PACE"
    71: "WHEELCHAIR RUN PACE"
    72: "TAI CHI"
    73: "MIXED CARDIO"
    74: "HAND CYCLING"
    75: "DISC SPORTS"
    76: "FITNESS GAMING"
    77: "DANCE"
    78: "SOCIAL DANCE"
    79: "PICKLEBALL"
    80: "COOLDOWN"
    3000: "OTHER"
- input_attribute: 'goal_type'
  output_attribute: 'goal_label'
  default_value: 'Unknown'
  values:
    0: "Open"
    1: "Distance in meters"
    2: "Time in seconds"
    3: "Kilocalories"
message:
- 'Activity: {activity_label}'
- 'Duration: {workout_duration}'
- 'Distance: {total_distance} km'
- 'Energy: {total_energy_burned} kcal Active / {total_basal_energy_burned} kcal Basal'
- 'Steps: {total_w_steps}'
- 'Flights Climbed: {total_flights_climbed}'
- 'Goal: {goal_label} ({goal})'
short_message:
- '{activity_label}: {total_distance} km in {workout_duration}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:health:wrist_temperature'
message:
- 'Wrist temperature: {wrist_temperature} °C'
- 'Surface temperature: {surface_temperature} °C'
- 'Device: {device_name} ({device_model})'
- 'Hardware/Software: {device_hardware} / {software_version}'
- 'Algorithm Version: {algorithm_version}'
- 'Source: {source}'
short_message:
- 'Wrist temperature: {wrist_temperature} °C via {device_model}'
short_source: 'SQLITE'
source: 'iOS Health database'
---
type: 'conditional'
data_type: 'ios:idstatuscache:lookup'
message:
- 'Process Name: {process_name}'
- 'Apple Identifier: {apple_identifier}'
short_message:
- 'Apple Identifier: {apple_identifier}'
short_source: 'PLIST'
source: 'Apple iOS identity services status cache plist'
---
type: 'conditional'
data_type: 'ios:imohdchat:message'
enumeration_helpers:
- input_attribute: 'status'
  output_attribute: 'status_string'
  default_value: 'UNKNOWN'
  values:
    0: 'Received'
    1: 'Sent'
message:
- 'Sender Name: {alias}'
- 'Message: {text}'
- 'Status: {status_string}'
short_message:
- 'Sender Name: {alias}'
- 'Message: {text}'
- 'Status: {status_string}'
short_source: 'IMO HD Chat message'
source: 'IMO HD Chat Message SQLite database'
---
type: 'conditional'
data_type: 'ios:instagram:message'
message:
- 'Sender Identifier: {sender_identifier}'
- 'Username: {username}'
- 'Message: {message_body}'
- 'Video Chat Identifier: {video_chat_call_identifier}'
- 'Video Chat Title: {video_chat_title}'
- 'Shared Media Identifier: {shared_media_identifier}'
- 'Shared Media URL: {shared_media_url}'
short_message:
- 'Username: {username}'
- 'Message: {message_body}'
short_source: 'Instagram iOS'
source: 'Instagram iOS threads'
---
type: 'conditional'
data_type: 'ios:kik:messaging'
enumeration_helpers:
- input_attribute: 'message_status'
  output_attribute: 'message_status'
  default_value: 'UNKNOWN'
  values:
    0: 'unread'
    2: 'message not sent'
    6: 'sent to Kik server'
    14: 'delivered '
    16: 'message read'
    30: 'read after immediate delivery'
    38: 'not a member of the group'
    66: 'delay in reaching Kik server'
    70: 'push notification sent'
    78: 'delivered after offline'
    94: 'read after offline'
- input_attribute: 'message_type'
  output_attribute: 'message_type'
  default_value: 'UNKNOWN'
  values:
    1: 'received'
    2: 'sent'
    3: 'message to group admin'
    4: 'message to group'
message:
- 'Username: {username}'
- 'Display name: {application_display_name}'
- 'Status: {message_status}'
- 'Type: {message_type}'
- 'Message: {message_body}'
short_message:
- '{message_body}'
short_source: 'Kik iOS'
source: 'Kik iOS messages'
---
type: 'conditional'
data_type: 'ios:lockdownd_log:entry'
message:
- 'Process identifer: {process_identifier}'
- 'Message: {message_body}'
short_message:
- 'Message: {message_body}'
short_source: 'LOG'
source: 'iOS lockdown daemon log'
---
type: 'conditional'
data_type: 'ios:mobile_backup:entry'
message:
- 'Activity description: {activity_description}'
short_message:
- 'Activity description: {activity_description}'
short_source: 'PLIST'
source: 'Apple iOS Mobile Backup application plist'
---
type: 'conditional'
data_type: 'ios:mobile_backup:state'
message:
- 'Description: {description}'
short_message:
- 'Description: {description}'
short_source: 'PLIST'
source: 'Apple iOS Mobile Backup application plist'
---
type: 'conditional'
data_type: 'ios:netusage:process'
message:
- 'Process Name: {process_name}'
- 'WiFi In: {wifi_in}'
- 'WiFi Out: {wifi_out}'
- 'Wired In: {wired_in}'
- 'Wired Out: {wired_out}'
- 'Wireless Wan In: {wireless_wan_in}'
- 'Wireless Wan Out: {wireless_wan_out}'
short_message:
- 'Process Name: {process_name}'
short_source: 'HISTORY'
source: 'iOS netusage.sqlite database'
---
type: 'conditional'
data_type: 'ios:netusage:route'
enumeration_helpers:
- input_attribute: 'network_type'
  output_attribute: 'network_type'
  default_value: 'UNKNOWN'
  values:
    1: 'wifi'
    2: 'cellular'
message:
- 'Bytes In: {bytes_in}'
- 'Bytes Out: {bytes_out}'
- 'Network Identifier: {network_identifier}'
- 'Network Signature: {network_signature}'
- 'Network Type: {network_type}'
short_message:
- 'Network Identifier: {network_identifier}'
- 'Network Type: {network_type}'
short_source: 'HISTORY'
source: 'iOS netusage.sqlite database'
---
type: 'conditional'
data_type: 'ios:notes:note'
message:
- 'Title: {title}'
- 'Content: {snippet}'
short_message:
- 'Title: {title}'
short_source: 'SQLITE'
source: 'iOS notes database'
---
type: 'conditional'
data_type: 'ios:powerlog:application_usage'
message:
- 'Application: {bundle_identifier}'
- 'Background Time: {background_time}'
- 'On Screen Time: {screen_on_time}'
short_message:
- 'Application: {bundle_identifier}'
short_source: 'HISTORY'
source: 'iOS powerlog database'
---
type: 'conditional'
data_type: 'ios:screentime:event'
message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Device Identifier: {device_identifier}'
- 'Device Name: {device_name}'
- 'Domain: {domain}'
- 'Total Time: {total_time}'
- 'User Family Name: {user_family_name}'
- 'User Given Name: {user_given_name}'
short_message:
- 'Bundle Identifier: {bundle_identifier}'
- 'Domain: {domain}'
short_source: 'HISTORY'
source: 'iOS Screen Time database'
---
type: 'conditional'
data_type: 'ios:sim:info'
message:
- 'Phone number: {phone_number}'
- 'SIM Type: {sim_type}'
- 'Cell broadcast version: {cell_broadcast_version}'
- 'Label identifier: {label_identifier}'
short_message:
- 'Phone number: {phone_number}'
short_source: 'PLIST'
source: 'iOS SIM Info'
---
type: 'conditional'
data_type: 'ios:sysdiag_log:entry'
message:
- 'Originating call: {originating_call}'
- 'Message: {message_body}'
short_message:
- 'Message: {message_body}'
short_source: 'LOG'
source: 'iOS sysdiag log'
---
type: 'conditional'
data_type: 'ios:sysdiagnose:logd:line'
message:
- 'Logger: {logger}'
- 'Message: {message_body}'
short_message:
- 'Message: {message_body}'
short_source: 'LOG'
source: 'iOS sysdiagnose log'
---
type: 'conditional'
data_type: 'ios:twitter:contact'
enumeration_helpers:
- input_attribute: 'following'
  output_attribute: 'following'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
message:
- 'Screen name: {screen_name}'
- 'Profile picture URL: {profile_url}'
- 'Name: {name}'
- 'Location: {location}'
- 'Description: {description}'
- 'URL: {url}'
- 'Following: {following}'
- 'Number of followers: {followers_count}'
- 'Number of following: {following_count}'
short_message:
- 'Screen name: {screen_name}'
- 'Description: {description}'
- 'URL: {url}'
short_source: 'Twitter iOS'
source: 'Twitter iOS Contacts'
---
type: 'conditional'
data_type: 'ios:twitter:status'
enumeration_helpers:
- input_attribute: 'favorited'
  output_attribute: 'favorited'
  default_value: 'UNKNOWN'
  values:
    0: 'No'
    1: 'Yes'
message:
- 'Name: {name}'
- 'User Id: {user_identifier}'
- 'Message: {text}'
- 'Favorite: {favorited}'
- 'Retweet Count: {retweet_count}'
- 'Favorite Count: {favorite_count}'
short_message:
- 'Name: {name}'
- 'Message: {text}'
short_source: 'Twitter iOS'
source: 'Twitter iOS Status'
---
type: 'conditional'
data_type: 'ios:wifi:known_networks:entry'
message:
- 'SSID: {ssid}'
- 'BSSID: {bssid}'
- 'Channel: {channel}'
short_message:
- 'SSID: {ssid}'
short_source: 'PLIST'
source: 'Apple iOS WiFi Known Networks plist file'
