Cash App

[GBurchDFIR]

I am trying to parse the CashApp transactions with iLeapp, however, it doesn't appear to be functioning correctly. I observed the transactions, but maybe the newer OSs are putting these in a new location. I have found the transactions in the following location: EXTRACTION_FFS.zip/root/private/var/mobile/Containers/Shared/AppGroup/CASH_APP_GUID/Environments/Production/Accounts/(USER CASHTAG)/CCEntitySync.sqlite. In this database is a table titled ZPAYMENT, and column zsyncpayment. In this column is a protobuf with what appears to be embedded json, which contains the transaction information. Please take a look at this, I am able to parse it manually and provide the information for the case, but it would be nice to have it parsed. I wish I was more adept at JSON.

[stark4n6]

@GBurchDFIR the parsers currently don't support that path so you may be correct in that it changed. Can you check here and here?

https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/cashApp.py

https://github.com/abrignoni/iLEAPP/blob/main/scripts/artifacts/cashAppB.py

See if either of those paths in the headers are in your data set. Also maybe try the sqlite queries too. If you can provide sample data we might be able to update it.

[GBurchDFIR]

Those paths are not in the reported parsers. I have no queries to pull it, I had to do some manual pulling of each of the entries, and put it into an excel spreadsheet. Time consuming, but needed for the case.

[stark4n6]

@GBurchDFIR can you check the paths from the current parsers in your data set and see if there is any data there first? If there is anything that can be provided to help update the parsers including new databases that would be helpful