Cracking the Code: How Apple Organizes App Data

David Tull
Dec 6, 2024
3 min read

If you’ve ever tried to dig into iOS data storage, you’ve probably faced the same headache I have - figuring out Apple’s file structure for third-party apps. For my workflow, I prefer manually combing through extracted data while letting a tool parse it in parallel. Once I identify an app that's relevant to the case, I dive into its folder to uncover details beyond what the tool might show. But the problem is knowing where to look for that data.

The Problem with Apple's Data Storage

Apple’s approach to storing app data is a mix of brilliance and frustration. On the one hand, it’s highly secure and well-structured. On the other, it can be a maze for investigators or anyone trying to analyze app data manually. iOS spreads app data across multiple locations, each with its own purpose and quirks.

Let’s break it down:

1. /private/var/mobile/Containers/Data/Application/

This is where an app keeps its private data. Every app gets its own container, identified by a unique 32-character UUID in the format 8-4-4-4-12.

Why it exists: To sandbox apps and keep their data secure and isolated. Other apps can’t access this directory, which protects user privacy.
What you’ll find here:
- User-generated content (e.g., photos, documents)
- Local databases (SQLite, Core Data)
- App-specific settings or cached data

2. /private/var/mobile/Containers/Shared/AppGroup/

This directory is for data sharing between apps that are part of the same App Group (like a main app and its widgets or extensions).

Why it exists: To let apps/extensions share data without duplicating it.
What you’ll find here:
- Shared databases or files
- Data used by widgets, custom keyboards, or companion apps

Why Two Locations?

Apple separates app data into these two areas for good reasons:

Security: Sandboxing ensures apps don’t step on each other’s toes.
Efficiency: Shared containers prevent redundancy when multiple extensions need access to the same data.
Organization: Developers follow clear guidelines for file management, which also simplifies backups and restores.

The UUID Conundrum

Here’s where things get tricky. The UUIDs for the Data directory and the AppGroup directory are different. When you’re working with a device that has hundreds of installed apps, it’s a pain to figure out which UUID belongs to which app.

Take the public iOS image from Josh Hickman as an example:

Data/Application: 263 folders
Shared/AppGroup: 142 folders

Manually sifting through all those folders is a nightmare. Sure, you can sort by size to narrow things down, but it’s still time-consuming. And to make matters worse, there’s no central file that links these UUIDs to their respective apps—at least not one I know of.

My Solution: A Simple Python Tool

Frustrated by the inefficiency of manual folder navigation, I decided to build a tool to automate the process. This Python script parses the UUIDs and organizes the data into a readable format.

Here’s how it works:

You input a zip file from an extraction.
The tool scans the Data/Application and Shared/AppGroup directories.
It reads the .plist files inside each folder to map UUIDs to app information.
It outputs the results in JSON format, showing the app's Bundle ID, file paths, and UUIDs.

For example, a snippet of the output looks like this:

{
  "BundleID":{ 
    "data_uuid": 
      ["8-4-4-4-12"],
    "data_filepath": 
      ["/private/var/mobile/Containers/Data/Application/..."],
    "app_group_uuid": 
      ["8-4-4-4-12"],
    "app_group_filepath": 
      ["/private/var/mobile/Containers/Shared/AppGroup/..."] 
  } 
}

You can filter results by Bundle ID. For instance, searching for life360 will pull up its data. Keep in mind, Bundle IDs aren’t always obvious — TikTok’s is com.zhiliaoapp.musically, for example. A quick Google search for "Bundle ID Finder" can help.

Every folder’s .plist file, located at its root, contains metadata about the app. My tool reads these files to extract key details. Structurally, the .plist files are identical in both Data and AppGroup directories, making it easy to unify results.