iPhone’s Tiger Text AppMarch 7, 2010
A new app for the iPhone is called Tiger text. The developers, X Sigma Partners, LLC, states “Send Texts that don’t live forever. Messages are deleted from both users’ phones. Be in control of the record you leave. Try Tiger text for free”.
As the above image states “Cover your Tracks”. Tiger Text is designed to send texts to other users of the application and that their conversations are then deleted, hence “Cover your Tracks”. This discussion will cover the use of the application, relevant database artifacts, and how it differs from the “Messages” app on the iPhone.
There are three tabs “Messages”, “Friends”, and “Settings”. The Messages tab is where the texts are sent and received. The friends tab contains a list of contacts. The settings tab is where the deletion settings are configured.
As seen in the next figure, the settings tab contains the following information,
- Cell Phone number
- Length of time until the texts are deleted
- Settings for deleting history upon closure of the app
- Settings for deleting the text after reading the message.
When a text is sent from a phone to another, the lifespan timer begins to start. Now this timer stops if the application is closed. Even if the delete history setting is activated. the history will not be deleted until all the timers have completed and or messages read. if not, the text message are still there until the app is restarted and the counters are allowed to finish. Once the message counter is completed, then paws replace the original text.
First lets look at the database that is created by this application. Located within the Application folder of the logical image, at /Private/var/mobile/Application directory, as shown in the next figures, the filename of relevance is “tigertext.sql”
Open the database with either SQLite Database Browser or Froq. There are 2 tables of interest, friends and messages. The friends’ table will give the examiner the following information,
- Display Name
- Phone number
- Date and time last modified
The Message Table can provide the following information if the application wasn’t allowed to delete the messages. The following data can possibly be retrieved,
- Sender username
- Sender phone number
- Recipient’s phone number
- Text message
- Date and time sent and set for deletion
- Settings for delete on read
- If the text was deleted
- If the Text was read
So the question remains, are they really deleted like in the iPhone’s SMS database? The answer is yes, they are deleted from it’s own SQLite database. After an examination of the database, the following figure shows the before and after of a message after the text was deleted by the application, and the paws remain.
A search on the complete database confirms that the text was actually deleted from the database.
Even if the title “Tiger” had any reference to the famous golfer, it was not the intention of the developers. Tiger text doesn’t appear to have any legitimate purpose. The app poses many problems for examiners. As with the “Messages” database on the iPhone, the texts are able to be deleted, however texts can be recovered from within the database. Tiger text makes sure that all texts are deleted and nothing is left behind from within its database.