All the third party applications are somehow organized the same way within iOS and they all belong to AppDomain
and are stored in the Data partition. All commercially available forensic tools focus on interrogating application data. Most of the valuable information is stored in property list and SQLite formats. Media, such as videos, photos, and audio, is stored in general within a subdirectory in the same application folder.
Here, we will go through a forensic analysis of WhatsApp, the well-known cross platform mobile messenger that has replaced many cases traditional SMS services and offers the ability to exchange unlimited text messages, sending and receiving photos, videos, sharing geolocation, audio messages, making VoIP calls, and more. The following was an acquisition from an iPhone 5 running iOS 9.2.
All WhatsApp data can be found in mobile/Application/net.whatsapp.WhatsApp/
and the most valuable files and directories are as follows:
ChatStorage.sqlite
StatusMessages...