iOS11- Do Not Disturb While Driving Analysis

In the past few years there has been a lot of press surrounding the issue of distracted driving. With good reason, statistics show that in 2015 in the United States 3400 people died in collisions where distracted driving was deemed to be a contributing factor.

With iOS11 Apple has responded with a new feature called "Do Not Disturb While Driving (DNDWD)."

We are going to look at how this new feature works and more importantly how it looks forensically.

How A User Sets Do Not Disturb While Driving

The new setting is found within Settings - Do Not Disturb - Do Not Disturb While Driving.

iOS 11 accessing Do Not Disturb While DrivingFigure One: iOS 11 accessing Do Not Disturb While Driving

Once the setting has been located, users need to activate the feature by selecting “Activate.” This setting has three options:

  1. Automatically (DNDWD will turn on when the device senses you are in a car)
  2. When connected to car Bluetooth
  3. Manually (the default setting where a user sets DNDWD each time)

DNDWD activation optionsFigure Two: DNDWD activation options

Users can choose to whom an auto-reply will be sent.

Auto-Reply settings

Figure Three: Auto-Reply settings

It should be noted that Apple ships this feature with a canned reply. Users have the ability to customize this reply by selecting the “Auto-Reply” option.

Lastly users can add the DNDWD option to the Control Center. To do this, users select Settings - Control Center - Customize Controls.

Adding DNDWD to the Control Center

Figure Four: Adding DNDWD to the Control Center

Once it has been added, the option appears to user when swiping up from the bottom.

DNDWD in Control Center

Figure Five: DNDWD in Control Center

Analysis

So how does this look when a device is analyzed?

Attach the iOS11 device to BlackLight and acquire. The settings for DNDWD are found at this location:

/mobile/Library/Preferences/com.apple.vehiclePolice.DNDMode.plist

The plist file associated with DNDWD

Figure Six: The .plist file associated with DNDWD

There are several values of interest contained in this .plist. We will handle each one individually.

CARDNDAutoReplyAudience:CARDNDAutoReplyAudience

CARDNDAutoReplyMessage: The message being sent by the system (remember that this can be customized by the user).

CARDNDAutomaticTriggeringMethod:

CARDNDAutomacticTriggerMethod

CARDNDTriggerPreferenceChangedTimestamp: This is the date and time the “Trigger Method” shown above was set (expressed in Webkit epoch).

CARDNDUserHasAdjustedTriggerMethod: This shows if the user has ever changed the setting from the default setting.

Lastly, has the user added the DNDWD icon to the Control Center? To determine this, we examine the following .plist.

/mobile/Library/ControlCenter/ModuleConfiguration.plist

ModuleConfiguration.plist view in iOS11

Figure Seven: ModuleConfiguration.plist view in iOS11

If a user has set the DNDWD icon into their Control Center, evidence of this will be found in the .plist file under the value:

com.apple.control-center.CarModeModule

And now you know.



Leave a Reply

Sorry, you must be logged in to post a comment.