Wi-Fi Network Preferences (com.apple.wifi.plist)

Location

Description

Property list file containing Wi-Fi configuration preferences including auto-join settings, hotspot configuration, network service ordering, and historical connection metadata. This file works in conjunction with the known-networks plist to manage wireless network behavior and stores additional connection preference data not present in the known-networks database.

Forensic Value

Wi-Fi preferences reveal network connection priorities and auto-join configurations that establish which networks the device connects to automatically, indicating frequently visited locations. Hotspot configuration data may reveal tethering activity between devices. Network service ordering shows the user preferred connectivity methods. Changes to Wi-Fi preferences can indicate network configuration manipulation by an attacker seeking to redirect traffic through a controlled access point. This artifact complements the known-networks plist with additional configuration context.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

ideviceinfo -u <UDID> -q com.apple.mobile.wireless_lockdown > wifi_prefs.txt

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References