Skip to content

Scope TikTok IM artifacts to TikTok-owned containers - #2067

Merged
abrignoni merged 1 commit into
mainfrom
fix/tiktok-ios-container-owner
Aug 29, 2026
Merged

Scope TikTok IM artifacts to TikTok-owned containers#2067
abrignoni merged 1 commit into
mainfrom
fix/tiktok-ios-container-owner

Conversation

@abrignoni

Copy link
Copy Markdown
Owner

Attributes every file matched by the TikTok message, contact and replied-message patterns to the app that owns its container, and parses only TikTok's.

  • The bare *AwemeIM.db* and ChatFiles db.sqlite patterns match by file name in any app container, and iOS containers are GUID directories, so the globs cannot be anchored the way Anchor TikTok IM path patterns to the TikTok package names ALEAPP#1238 anchored the Android ones. The owner is read from the container's own .com.apple.mobile_container_manager.metadata.plist, or from the AppDomain bundle id a backup-reconstructed path carries.
  • Containers owned by another app, or whose owner cannot be established, are skipped and logged.
  • Row counts are unchanged on the tested corpora. A constructed image holding the same store in a TikTok container, a decoy container and an unattributable container parses only the TikTok copy; unpatched, every count triples.

The TikTok message, contact and replied-message patterns match AwemeIM.db
and the ChatFiles db.sqlite by file name in any app container. iOS
containers are GUID directories, so the globs cannot carry the app
identity the way the Android patterns do. Each matched database is now
attributed to the app named by its container's own
.com.apple.mobile_container_manager.metadata.plist, or by the AppDomain
bundle id a backup-reconstructed path carries, and only containers owned
by com.zhiliaoapp.musically are parsed. Anything else is skipped and
logged. Row counts are unchanged on the tested corpora.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
@abrignoni
abrignoni merged commit ebfe4d6 into main Aug 29, 2026
10 checks passed
@abrignoni
abrignoni deleted the fix/tiktok-ios-container-owner branch August 29, 2026 04:28
pull Bot pushed a commit to arc675/ileapp that referenced this pull request Aug 29, 2026
…ners

Extends the abrignoni#2067 container-owner check to tiktok_app_sessions and
tiktok_watch_history: the metadata plist glob joins their paths, matched
databases in containers not owned by com.zhiliaoapp.musically are skipped
and logged, and Watch History records checked absences for four corpora.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant