iOS11- Do Not Disturb While Driving Analysis
With iOS11 Apple has responded with a new feature called “Do Not Disturb While Driving (DNDWD).”
We are going to look at how this new feature works and more importantly how it looks forensically.
How A User Sets Do Not Disturb While Driving
The new setting is found within Settings – Do Not Disturb – Do Not Disturb While Driving.
Figure One: iOS 11 accessing Do Not Disturb While Driving
Once the setting has been located, users need to activate the feature by selecting “Activate.” This setting has three options:
- Automatically (DNDWD will turn on when the device senses you are in a car)
- When connected to car Bluetooth
- Manually (the default setting where a user sets DNDWD each time)
Figure Two: DNDWD activation options
Users can choose to whom an auto-reply will be sent.
Figure Three: Auto-Reply settings
Lastly users can add the DNDWD option to the Control Center. To do this, users select Settings – Control Center – Customize Controls.
Figure Four: Adding DNDWD to the Control Center
Figure Five: DNDWD in Control Center
So how does this look when a device is analyzed?
Attach the iOS11 device to BlackLight and acquire. The settings for DNDWD are found at this location:
Figure Six: The .plist file associated with DNDWD
CARDNDAutoReplyMessage: The message being sent by the system (remember that this can be customized by the user).
CARDNDTriggerPreferenceChangedTimestamp: This is the date and time the “Trigger Method” shown above was set (expressed in Webkit epoch).
CARDNDUserHasAdjustedTriggerMethod: This shows if the user has ever changed the setting from the default setting.
Lastly, has the user added the DNDWD icon to the Control Center? To determine this, we examine the following .plist.
Figure Seven: ModuleConfiguration.plist view in iOS11
If a user has set the DNDWD icon into their Control Center, evidence of this will be found in the .plist file under the value:
And now you know.