

We next turn to understanding the behavior and features of these vault apps and how to extract the hidden information from artifacts of the app's stored data. We show an effective and very fast identification of content hiding apps through a two-phase process: initial categorization using keywords followed by more precise binary classification. We consider not only the US Store but also give results for App Stores in Russia, India and China. In this work we focus on iOS devices and first describe how to identify content hiding applications from the App Store. A subclass of these applications called decoy apps further supports secret hiding by having a mode which mimics standard apps such as calculators but can turn into a vault app through entering a specific input. Content hiding (or vault) apps are a class of applications that allow users to hide photos, videos, documents and other content securely.
