skills.rest
dreadnode
dreadnodeOFFICIAL
Explore all skills by this author →
Website𝕏@dreadnodeGitHub

communications-analysis

Analyze iOS communication data to identify forensic evidence and security threats.

11|1|Updated May 4, 2026
Search Tags:#threat-detection#digital-forensics#ios-forensics#communications-analysis#sms-analysis#call-history#sqlite-query
One-click install
npx skills add https://github.com/dreadnode/capabilities --skill communications-analysis
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: communications-analysis
Source: https://github.com/dreadnode/capabilities/tree/main/capabilities/ios-forensics/skills/communications-analysis
Command: npx skills add https://github.com/dreadnode/capabilities --skill communications-analysis

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill solves the challenge of manually reviewing large volumes of iOS communication data from device acquisitions to identify relevant forensic evidence, anomalous activity, and potential security threats including social engineering lures, suspicious URLs, and unknown correspondents.

Core Features & Use Cases

  • Multi-surface communication analysis: Supports built-in iOS communications (SMS/iMessage, call history, contacts, mail) plus common third-party messengers including Signal, WhatsApp, Telegram, and WeChat.
  • Anomaly and threat detection: Flags high-risk patterns like smishing URLs, short-code spam, FaceTime-based exploit probes, and deleted but recoverable message records.
  • Use case: For an incident involving suspected Pegasus spyware, use this Skill to reconstruct the subject's full communication graph, identify one-click lure messages, and extract durable, court-admissible evidence of targeted outreach.

Quick Start

Use the communications-analysis skill to review all communication data from the provided iOS acquisition to surface any suspicious URLs, unknown contacts, and deleted message records related to the incident window.

Frequently Asked Questions about communications-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze iOS backup data for forensic evidence and security threats?▼

iOS backup analysis for forensic evidence extracts and queries SQLite databases across SMS, iMessage, call history, contacts, and mail to identify anomalous activity and security threats. It reconstructs communication graphs tied to specific extracted data rows.

Can I detect spyware lures and smishing URLs in iOS message history?▼

Detecting spyware lures and smishing URLs in iOS message history flags high-risk patterns like social engineering lures, suspicious short-code spam, and FaceTime exploit probes. It identifies one-click lure messages associated with targeted campaigns.

Does iOS forensics analysis support third-party messengers like WhatsApp and Signal?▼

iOS forensics analysis supports third-party messengers including Signal, WhatsApp, Telegram, and WeChat alongside built-in SMS and iMessage. It extracts communication records from these apps to identify unknown correspondents and suspicious activity.

What is the best way to match STIX IOCs against iOS communication records?▼

Matching STIX IOCs against iOS communication records integrates structured threat indicators for automated matching against extracted SMS, mail, and messenger data. It surfaces correlated threat evidence tied to specific communication events within the targeted time window.

How do I recover deleted SMS and iMessage records from an iOS acquisition?▼

Recovering deleted SMS and iMessage records from an iOS acquisition queries SQLite databases to flag deleted but recoverable message fragments. It surfaces hidden communication evidence that remains persisted within the device backup.

Can I scope communication activity to a specific incident time window?▼

Scoping communication activity to a specific incident time window filters extracted SMS, call history, and messenger records by targeted timestamps. It isolates relevant forensic evidence and reconstructs the communication graph within that defined period.

Related Skills

Explore More Data & Analytics Skills→
TechNickAITechNickAI
75

quo

Query Quo business phone system for calls, texts, contacts, and transcripts.

Community
Intermediate
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
Muath2000Muath2000

threat-intel-engineer

Integrate, normalize, and correlate cyber threat data from STIX/TAXII feeds.

Community
Advanced
dreadnodedreadnode
11

activity-reconstruction

Reconstruct evidence-backed iOS device activity timelines from system artifacts.

Official
Advanced