In the past few years there has been a lot of press surrounding the issue of distracted driving. With good reason, statistics show that in 2015 in the United States 3400 people died in collisions where distracted driving was deemed to be a contributing factor.
With iOS11 Apple has responded with a new feature called "Do Not Disturb While Driving (DNDWD)."
We are going to look at how this new feature works and more importantly how it looks forensically.
How A User Sets Do Not Disturb While Driving
The new setting is found within Settings - Do Not Disturb - Do Not Disturb While Driving.
Figure One: iOS 11 accessing Do Not Disturb While Driving
Once the setting has been located, users need to activate the feature by selecting “Activate.” This setting has three options:
- Automatically (DNDWD will turn on when the device senses you are in a car)
- When connected to car Bluetooth
- Manually (the default setting where a user sets DNDWD each time)
Figure Two: DNDWD activation options
Users can choose to whom an auto-reply will be sent.
Figure Three: Auto-Reply settings
It should be noted that Apple ships this feature with a canned reply. Users have the ability to customize this reply by selecting the “Auto-Reply” option.
Lastly users can add the DNDWD option to the Control Center. To do this, users select Settings - Control Center - Customize Controls.
Figure Four: Adding DNDWD to the Control Center
Once it has been added, the option appears to user when swiping up from the bottom.
Figure Five: DNDWD in Control Center
So how does this look when a device is analyzed?
Attach the iOS11 device to BlackLight and acquire. The settings for DNDWD are found at this location:
Figure Six: The .plist file associated with DNDWD
There are several values of interest contained in this .plist. We will handle each one individually.
CARDNDAutoReplyMessage: The message being sent by the system (remember that this can be customized by the user).
CARDNDTriggerPreferenceChangedTimestamp: This is the date and time the “Trigger Method” shown above was set (expressed in Webkit epoch).
CARDNDUserHasAdjustedTriggerMethod: This shows if the user has ever changed the setting from the default setting.
Lastly, has the user added the DNDWD icon to the Control Center? To determine this, we examine the following .plist.
Figure Seven: ModuleConfiguration.plist view in iOS11
If a user has set the DNDWD icon into their Control Center, evidence of this will be found in the .plist file under the value:
And now you know.