iOS updates are always a whirlwind of new features, and iOS 18 is no exception. While the headline-grabbing changes often focus on revamped interfaces and flashy tools, there’s a quieter revolution happening beneath the surface: the ability to manage and even hide apps in ways we haven’t seen before.

The Hidden Potential:

For years, iOS users have been limited in their app management. Folders helped, but they were still visible on the home screen. iOS 18 introduces a game-changer: the ability to “truly” hide apps. This isn’t just about tucking them away in a folder; it’s about making them disappear from your home screen and app library entirely. This initially created a concern in the DFIR community with one more Apple hurdle to deal with. However, as each company did research the forensic side came out on top with hidden Apps on iOS.

Let’s start with how the function works.

• Select apps to hide.
• Require authentication (Face ID, Touch ID, or passcode) to access hidden apps.
• Potentially create custom folders or sections for hidden apps within settings.

Following these steps, you can hide the App from plain view. When we process a device with these Apps hidden with digital forensics, we now have additional meta data that needs to be reviewed.

Using Paraben’s E3 Forensic Platform we can see the full list of Apps on the device. As we inspect further, we can see in the meta data which of these Apps were hidden.

To support the “recovery” of these hidden/locked Apps what do you need to adjust in your process. If the iOS backup password is known the data is captured with an enhanced logical acquisition (Encrypted backup) that also accesses keychain data. Each tool then would need to process the additional available data for the hidden/locked Apps.

Additional data that is show is the App status include if an App was hidden/locked and if it was locked with a password. After the acquisition is complete and you see this type of data is available it is time to dive into the potentially locked App and see what is available.

In the following example you can see the data listed that includes the basics about the App and some of the user-oriented data. However, you might notice you don’t see all the user data.

When that happens, this is when you need to consider an additional potential data source for the data. Navigate to the keychain data and see if a key is present. If there is a key present, go to capture that data from the cloud. As with all things mobile you never know when a data source will be spread across multiple areas.

In these screenshots I have captured the cloud data from Facebook. As a note always use a proxy or VPN when collecting from cloud data sources.

Once the data is collected, I can open and review that information.

For digital investigators, these changes present both challenges and opportunities. Hidden and locked apps could potentially conceal crucial evidence. However, they also create new avenues for data recovery and analysis from a forensic perspective where additional capabilities are available to capture that information that an end user or suspect would be aware of.

All the screen captures and capabilities were done with Paraben’s E3 Forensic Platform.