Investigating iOS Truth Social
10/10/2025 Friday
Truth Social is a social media platform founded by former President
Donald J. Trump. The claimed goal behind creating this platform is to
create an alternative to mainstream platforms like Twitter and Facebook.
It aims to provide a space for free speech, emphasizing a commitment to
"uncensored" user expression. Truth Social operates under Trump Media &
Technology Group (TMTG), with a mission to challenge what it describes
as Big Tech's monopoly on information flow.
Digital Forensics Value of iOS Truth Social
Android Truth Social has significant digital forensic value for
investigating user activities, communications, and content. Key
artifacts include user profiles and media files. Metadata like
timestamps and geolocation help reconstruct timelines of events. Media
files and shared links can reveal additional evidence, including file
origins and external threats. It supports investigations into
harassment, disinformation, influence networks, and cybercrime.
Location of iOS Truth Social Artifacts
iOS Truth Social artifacts can be found at the following location:
private/var/mobile/Containers/Shared/AppGroup/<App-GUID>/ChatModel.sqlitSe
Analyzing iOS Truth Social Artifacts with ArtiFast
This section will discuss using ArtiFast to extract iOS Truth Social
artifacts from iOS device files and what kind of digital forensics
insights we can gain from the artifacts.
After you have created your case and added evidence for the
investigation, at the Artifact Selection phase, you can select iOS Truth
Social artifacts:
×
Once ArtiFast parser plugins complete processing the artifact for analysis, it can be reviewed via “Artifact View” or “Timeline View,” with indexing, filtering, and searching capabilities. Below is a detailed description of iOS Truth Social artifacts in ArtiFast.
iOS Truth Social Account
- Account User Name: The user name.
- User ID: The User identifier.
- Creation Date: The date and time the account was created.
- Is Verified: Indicates whether the account is verified or not.
- Avatar: The user profile picture’s URL.
iOS Truth Social Messages
- Sending Date/Time (UTC): The message sending date and time UTC.
- Type: The type of this message.
- Sender ID: The message sender ID.
- Direction: The message direction (Incoming/outgoing).
- Message ID: The message identifier.
- Chat ID: The chat Identifier.
- Is Hidden: Indicates whether the message was hidden or not.
- Content: The content of the message.
- Is Read: Indicates whether the message was read or not.
- Message Content: The message body content.
iOS Truth Social Chats
- Date/Time: The date and time the chat was created (UTC).
- Partner’s ID: The ID of the other chat member.
- Owned By ID: The chat creator user identifier.
- Number of Participants: The number of chat participants.
- Chat Type: The Chat type.
- Chat ID: The Chat’s identifier.
- Last Read At: The time and date when the chat was last read.
- Is Silenced: Indicates whether the chat was silenced or not.
- Is Hidden: Indicates whether the chat was hidden or not.
- Is Blocked: Indicates whether the chat was blocked or not.
- Is Accepted: Indicates whether the chat was accepted or not.
iOS Truth Social Attachments
- Attachment ID: The ID of the attachment.
- Type: The attachment file type.
- Preview URL: The attachment preview URL.
- URL: The attachment URL.
- Original Width: The attachment file original width.
- Original Height: The attachment file original height.
For more information or suggestions please contact: ekrma.elnour@forensafe.com
