Don’t Overlook the Significance of AirDrop Logs in iOS Analysis - ArcherHall (2024)

A client once came to me with a concern for his privacy, as he started receiving his own private photos sent to him from a friend that he had a falling-out with. He did not know how his ex-friend could have these photos in their possession, and he was worried that his iPhone had been hacked somehow. I analyzed his phone over the course of two weeks and did not find any proof of spyware on the device. I did however find AirDrop transfers to an iPad, and he did not own an iPad. This was very likely his ex-friends doing and would explain the blackmail style messages he was receiving. This highlighted the high value in analyzing these logs from iOS devices.

AirDrop logs are stored within the sysdiagnose log archive on iOS devices, and contain a plethora of valuable information. These logs can contain useful information showing files transferred to and from the device via AirDrop. Depending on phone use, these logs can show data going back a few days to possibly 2 weeks, so time is an important factor when analyzing these logs.

In any investigation or eDiscovery matter, obtaining a copy of the sysdiagnose log archives is a good idea; however, obtaining them can be challenging if access to the device is limited. These logs can be generated within the device and then (ironically) AirDropped to an Apple computer for review. Alternatively, the logs can be obtained from a forensic image if the device is jailbroken. If the device is jailbroken, that means that a physical image can be acquired, which pulls many additional system logs, including the sysdiagnose log archive.

Don’t Overlook the Significance of AirDrop Logs in iOS Analysis - ArcherHall (2024)

FAQs

Is AirDrop history traceable? ›

The answer is "no." AirDrop does not keep a log of these transactions so you can audit them later. You could supervise the devices and turn AirDrop off, no?

Can iPhone be hacked through AirDrop? ›

AirDrops are files exchanged through an Apple-exclusive feature simplifying data transfers between Macs and iOS devices. However, hackers and users can abuse this wireless and readily available option. For instance, keep Wi-Fi and Bluetooth turned off in public or when not in active use.

How do I check my AirDrop sharing history? ›

There is not a feature for seeing your AirDrop history. On iPhone or iPad, view items shared with you through AirDrop by going to the relevant app. On Mac, go to your Downloads folder to see files shared with you via AirDrop.

What is the importance of AirDrop in iPhone? ›

Apple AirDrop is a native feature in iOS and macOS that lets users share data from one device to another on the same Wi-Fi network. AirDrop allows users to share photos, videos, websites and locations between devices that are up to about 30 feet apart.

Can someone get your phone number from AirDrop? ›

Apple's AirDrop feature could expose personal contact information details to nearby strangers, a team of researchers has said. The file-sharing shortcut, which is available on iOS, iPadOS and macOS, allows users to quickly and easily send photos, documents and more when another Apple device is nearby.

Is AirDrop completely Anonymous? ›

Airdrop does not support anonymity. Your identity is displayed on the recipient's phone when you send something to them.

Is AirDrop a security risk? ›

Apple has implemented several security features to ensure that data transfers are private and secure. By using encryption and direct device-to-device transfers, AirDrop provides a safe way to share files between Apple devices.

Is it bad to have AirDrop on? ›

The connectivity of your AirDrop can only be compromised when it's turned on. To be on the safe side, ensure that you turn on your AirDrop only when you want to use it. Once you are done using it, turn it off.

Why can anyone see my AirDrop? ›

AirDrop is restricted to Contacts only on the recipient device. Wi-Fi or Bluetooth is turned off on either device. Devices are far from each other. Airplane mode or Do Not Disturb mode is enabled on the recipient's phone.

What is Sysdiagnose on iPhone Analytics? ›

Sysdiagnose is a utility on most Apple devices that can be used to gather system-wide diagnostic information. It includes logging from different services and reports on the state of systems.

What information does AirDrop share? ›

With AirDrop, you can wirelessly send your photos, videos, websites, locations, and more to other nearby devices and Mac computers (iOS 7, iPadOS 13, OS X 10.10, or later required). AirDrop transfers information using Wi-Fi and Bluetooth—both must be turned on.

How far away does AirDrop work? ›

Phones with AirDrop enabled can exchange files from up to 30 feet away, whether or not they're in each other's contact lists. Many adults use AirDrop to share files one-on-one, but teens have embraced mass image sharing via AirDrop for years.

Can you trace an AirDrop message? ›

As mentioned earlier, AirDrop is a non-conventional way to transfer files across iPhones, iPad, Macbooks, etc. Therefore, Apple doesn't keep the logs of the files airdropped. So the answer to the question of "can you see AirDrop History?" is no.

Can AirDrop go through walls? ›

Stay Nearby: Since it uses Wi-Fi to make the transfer, AirDrop should be able to connect through walls and other obstacles.

Can I AirDrop to someone else's phone? ›

AirDrop only allows you to send and receive pictures between Apple devices. If you want to transfer photos to Android devices or even to a Windows PC, you should use a file transfer app.

How do I make AirDrop private? ›

Here's how to turn off AirDrop, or configure it so you only get drops from people you know
  1. Open settings on your iPhone.
  2. Choose “General.”
  3. Tap “AirDrop.”
  4. Change the setting from “Everyone” to “Contacts Only” or “Receiving off.”
Jun 18, 2019

How do I block someone from Airdropping me? ›

Tap on the AirDrop icon, and it will pull up the allowable senders dialog. You can open up AirDrop to all recipients, limit it to Contacts only, or turn off the feature entirely. On iOS 11, the best way to toggle the allowed senders or to turn off the feature is in Settings.

What is illegal to AirDrop? ›

Cyberflashing is a crime which involves sending obscene pictures to strangers online, often done through AirDrop. The term can also apply to the same action carried out entirely through Bluetooth and other online services.

Why you should turn off AirDrop? ›

AirDrop security risks

Research by the Technical University of Darmstadt in Germany found that the Apple Wireless Direct Link (AWDL), the networking protocol used for AirDrop, could leave users susceptible to man-in-the-middle cyberattacks, such as intercepting data in transit or tracking users.

Why turn off AirDrop? ›

If you'd rather avoid having your iPhone expose your contact info to creeps and protect yourself from cyber-flashers, you can turn AirDrop off(opens in a new tab) (and disable Bluetooth while you're at it).

Why did Apple turn off AirDrop? ›

The change rolled out shortly after major media publications, including The New York Times, had reported how Chinese protestors were using AirDrop to send messages denouncing China's President Xi Jinping as well as to share information about protests and instructions on how to download VPNs to bypass the country's ...

Can viruses be shared on AirDrop? ›

Hackers can use wireless data transfer technologies such as Apple AirDrop to send unwanted or malicious files to people's devices, warns Boris Lopatin, a senior expert on the investigation of fraud cases at MegaFon.

What is Jetsamevent on iPhone? ›

What is Jetsamevent on iPhone Analytics? Jetsamevent is an iPhone analytics tool that provides users with detailed information about their app usage. It includes data on app crashes, system crashes, and other app-related issues. Jetsamevent also provides users with tips on how to improve their app usage.

Should you turn off iPhone Analytics? ›

Why Should I Turn Off iPhone Analytics? Your iPhone uses a little bit of battery life each time it sends your usage data to Apple. By turning off analytics, your iPhone is saving a little bit of battery life each time it would have sent data to Apple.

What is jetsam Apple Analytics? ›

The jetsam events occur when the processor memory is almost full and apps are told to release any memory they can. You may be running an app that downloads a lot of data. Browsing websites with lots of ads can produce this. The log files are dated, so you can see if they seem to be linked to the freeze-ups.

What is the difference between AirDrop and messaging? ›

Often when you want to share photos with someone, you'll either text it or email it. While that will work, it can be much faster to just use AirDrop to send the picture(s) to them. The only requirements are that both devices are from Apple and the devices are in close proximity to one another.

How can I get text messages from two iPhones with another Apple ID? ›

On your iPhone, go to Settings > Messages > Text Message Forwarding. If you don't see Text Message Forwarding, go to Settings > Messages. Turn off iMessage, then turn it back on. Tap Send & Receive, tap Use Your Apple ID for iMessage, then sign in with the same Apple ID used on your other devices.

Does AirDrop send metadata? ›

Sharing via AirDrop

This includes the full quality photo and all metadata, including the photo's location, edit history, and caption. The recipient can dive into any edits you made to the photo and make their own changes or revisions.

How far does AirDrop reach? ›

Also, AirDrop only works with devices that are within about 10 meters, or 30 feet, because it uses Bluetooth to create a connection (that's the distance limit for Bluetooth connectivity), then creates the peer-to-peer Wi-Fi network.

Can you accidentally send an AirDrop? ›

So how do we cancel an accidental AirDrop transfer? The process to cancel AirDrop transfers is quite simple. While making an AirDrop transfer if you end up tapping on the wrong user you can quickly cancel it by tapping on his or her display picture and name one more time.

Where are AirDrop PDF files on iPhone? ›

You'll find the AirDropped files in the "Downloads" folder.

Where are AirDrop settings? ›

Apple iPhone - Turn AirDrop On / Off
  • From a Home screen on your Apple® iPhone®, navigate: Settings. General. . If an app isn't available on your Home screen, swipe left to access the App Library.
  • AirDrop. .
  • Select the AirDrop setting: Receiving Off. : AirDrop turned off. Contacts Only.

Can anyone see what you AirDrop? ›

Yes .. the person or people who see the AirDrop will see who sent it .. this can be changed in iOS's customizable Control Center .. Receiving Off: You won't receive AirDrop requests from anyoDropne .. Contacts Only: Only people in your Contacts app can see your device ..

How accurate are airdrops? ›

JPADS increases aircraft and payload survivability and enables delivery of multiple loads to single or multiple drop zones in a single aircraft pass with accuracy better than 150 meters with 80 percent confidence.

Why did I get a random AirDrop? ›

If you have Bluetooth and Wi-Fi turned on, anyone could try to AirDrop something to your device. Depending on the file, it's likely you'll see an image preview first, and you'll be prompted to accept or decline the AirDrop.

Is AirDrop permanent? ›

AirDrop now offers three settings for users: Receiving Off, Contacts Only, and Everyone for 10 Minutes. There is no longer a way to permanently leave AirDrop on.

Where is AirDrop data stored? ›

AirDrop files are stored in the app that matches them. For example, pictures will be saved in your Photos app. A presentation will be saved in Keynote. Contacts will be saved in Contacts.

How do I change my AirDrop name? ›

Follow these steps to update your AirDrop name on your iPhone:
  1. Open your iPhone Settings.
  2. Tap General.
  3. Tap About.
  4. Tap Name.
  5. Type a new name for your iPhone in the name field. It's best to keep it short so that people can read it easily.
5 days ago

Does AirDrop use iCloud? ›

It does not use iCloud when using AirDrop from one device to another. Both must have Bluetooth and Wi-Fi On.

How do I edit AirDrop settings? ›

To change these settings, choose Apple menu > System Settings, click General in the sidebar, then click AirDrop & Handoff on the right. (You may need to scroll down.) If your Mac supports Handoff, turn on Handoff between your Mac, iPhone, iPad, and Apple Watch. See Pick up where you left off with Handoff.

Top Articles
Latest Posts
Article information

Author: Kerri Lueilwitz

Last Updated:

Views: 6118

Rating: 4.7 / 5 (47 voted)

Reviews: 86% of readers found this page helpful

Author information

Name: Kerri Lueilwitz

Birthday: 1992-10-31

Address: Suite 878 3699 Chantelle Roads, Colebury, NC 68599

Phone: +6111989609516

Job: Chief Farming Manager

Hobby: Mycology, Stone skipping, Dowsing, Whittling, Taxidermy, Sand art, Roller skating

Introduction: My name is Kerri Lueilwitz, I am a courageous, gentle, quaint, thankful, outstanding, brave, vast person who loves writing and wants to share my knowledge and understanding with you.