System log files also reveal the location of Pegasus binaries on disk. These file names match those we have consistently observed in the process execution logs presented earlier. The binaries are located inside the folder /private/var/db/com.apple.xpc.roleaccountd.staging/ which is consistent with the findings by Citizen Lab in a December 2020 report.

downloaded binary in the fsCachedData sub-folder, but it was unfortunately encrypted

It is interesting to note that in the traces Amnesty International recovered from 2019, the iMessage lookups that immediately preceded the execution of suspicious processes often contained two-bytes 0x00 padding in the email address recorded by the ID Status Cache file

iOS keeps a record of Apple IDs seen by each installed application in a plist file located at /private/var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist. This file is also typically available in a regular iTunes backup, so it can be easily extracted without the need of a jailbreak.

these redirects do not only happen when the target is navigating the Internet with the browser app, but also when using other apps

forensic investigations

forensic

There are three kinds of rhetoric: A. political (deliberative), B. forensic (legal), and C. epideictic (the ceremonial oratory of display). Their (1) divisions, (2) times, and (3) ends are as follows: A. Political (1) exhortation and dehortation, (2) future, (3) expediency and inexpediency; B. Forensic (1) accusation and defence, (2) past, (3) justice and injustice; C. Epideictic (1) praise and censure, (2) present, (3) honour and dishonour.

For of the three elements in speech-making -- speaker, subject, and person addressed -- it is the last one, the hearer, that determines the speech's end and object. [1358b] The hearer must be either a judge, with a decision to make about things past or future, or an observer. A member of the assembly decides about future events, a juryman about past events: while those who merely decide on the orator's skill are observers. From this it follows that there are three divisions of oratory-(1) political, (2) forensic, and (3) the ceremonial oratory of display.

The Forensic speaker should have studied wrongdoing -- its motives, its perpetrators, and its victims. Definitions of wrongdoing as injury voluntary inflicted contrary to law. Law is either (a) special, viz. that written law which regulates the life of a particular community, or (b) general, viz. all those unwritten principles which are supposed to be acknowledged everywhere. Enumeration and elucidation of the seven causes of human action, viz. three involuntary, (1) chance, (2) nature, (3) compulsion; and four voluntary, viz. (4) habit, (5) reasoning, (6) anger, (7) appetite. All voluntary actions are good or apparently good, pleasant or apparently pleasant. The good (or expedient) has been discussed under political oratory. The pleasant has yet to be considered.

There are three kinds of rhetoric: A. political (deliberative), B. forensic (legal), and C. epideictic (the ceremonial oratory of display).