What the OfferUp app leaves on an iPhone

Summary

• OfferUp's listings, chat, offers and meet-up arrangements are held by the service. In the two containers that carry the app we found no listing, no chat message and no meet-up detail in any store the parser reads.
• What is on the phone is narrower: account and device identifiers, search and posting areas, recent searches, listing identifiers kept for the feed, unsent chat drafts, session timing and a small cache of requests.
• Public records describe offenders using marketplace sales to lure sellers and buyers into robberies. They describe the offenders' conduct, and the app is a legitimate service used by millions.
• An empty chat or listing table is "cannot say", not "no contact". The phone cannot answer that question, and the service can.
• Counts here describe two containers from research images. They are not rates.

What the app does and who uses it

OfferUp is a mobile marketplace for buying and selling, mostly locally. Its App Store listing describes a place to buy and sell new and secondhand goods such as furniture, electronics, clothing and used cars. Items can be filtered by category, price and location. Buyers and sellers message each other inside the app, and ratings and profiles are there to build trust. People can meet in person or search nationwide. The listing carries an age rating of 16+ and about 4.4 million ratings. The company's own page adds jobs, rentals and services, and states more than 40 million active users and more than 30 million transactions a year. Those are the company's figures, and we have not checked them.

Its legitimate users are ordinary: someone clearing a garage, a small seller, a family buying a used car. For the meeting stage, OfferUp announced Community MeetUp Spots in 2017: public, well-lit places under surveillance, set up with local police, with more than 450 signs installed since the summer of that year. It then said it worked with more than 800 police departments. The app's scheduling tool helps people find a verified spot.

The point for an examiner is in that description. The app is a front end to a service. The listing, the other person's profile and the conversation are things the service holds and the app shows. That shapes everything below.

Why this app matters to an examiner

A marketplace sale ends in a meeting between strangers, often with cash or a valuable item. Police and prosecutors have described offenders turning that into a lure. Figure 1 sets out the public record we read, with the publisher and date of each item. Each statement belongs to its source.

In Seattle, a police blotter post of 1 July 2021 said detectives were investigating a series of armed robberies connected to OfferUp sales. It described three incidents in June 2021 during attempted vehicle and motorcycle sales and purchases, with gunfire in one and a victim pistol-whipped in another. A local news report the same day gave the dates as 14, 24 and 29 June. It carried no statement from OfferUp. Police advised caution and pointed to the parking lots of three precincts as places to meet. In September 2021, a television report said Seattle police warned sellers to meet in public, in daytime, and to tell someone where they were going.

At federal level, a Tampa Free Press report of 14 August 2024 on a sentencing in the Southern District of Florida said four men were sentenced for robbing people who had listed electronics for sale through OfferUp. According to that report, the conduct ran from September to October 2022: the men contacted sellers as interested buyers and robbed them at arranged meeting places, and the sentences ranged from nearly four years to 28 years. The report names the FBI's Miami office and the Plantation Police Department as investigators. The U.S. Attorney's Office for that district has published releases on the case. The Lab's automated fetch could not load those pages, so this article does not rely on them, and a reader should read them directly.

Category-level sources describe a second kind of misuse, fraud on sellers. The Federal Trade Commission's consumer advice for online sellers, published 27 July 2022, describes fake payment notices, claimed overpayments and requests for verification codes, and suggests selling locally and taking cash. A February 2025 FTC alert describes fake checks sent to people selling cars online. Neither names OfferUp. We cite them as context for the category, and do not suggest they concern this app.

The two kinds leave different traces. A robbery lure runs through a listing, a chat and a place. A payment scam runs through a chat and a payment. In both, the part an examiner most wants sits with the service.

Why the Lab chose it

We compared the apps found in the Lab's research images with what the open-source iLEAPP parser reads. Across the 9 distinct iPhone images, 731 non-stock apps appeared; 51 were parsed by iLEAPP, 4 partly, and 676 not at all (against the project's main branch on 6 November 2026). We ranked the gaps by public-record relevance. OfferUp came third of ten.

That ranking rests on app-specific sources, namely the Seattle statements and the Florida case, and not on category context alone. It does not rest on how often the app turns up: it is in only 2 of the 9 images, which is also why the parser was built from two containers, not twenty. The ranking is a judgment about usefulness to an examiner. It is not a measure of how common misuse is. The inventory counted 36 database-like files, 85 JSON files and 688 media files for the app, and most of the container's files are image caches.

Method

We worked read only on research images. For each container we listed the files, identified the store formats, and recorded schema names and counts, never values. Four store families carry the app's own state: redux-persist and Statsig data held in MMKV files, React Native AsyncStorage (a manifest plus overflow files), the app's preference file, and the URL cache database. A fifth, a Core Data database, had four tables with no rows, and the Apollo cache file was empty in both images.

We then wrote an iLEAPP module that reads seven artifacts and tested it on synthetic containers we generate: one shaped like the newer build, one like the older, and a decoy container from a different app that uses the same Documents/mmkv folder names, which must produce no rows. The module accepts MMKV stores only from a container that its metadata file or a bundle-named path identifies as OfferUp. Thirteen of thirteen test-case units pass, ten unit tests pass, and the project's own claim-language, path and safety checks pass. No data from any research image leaves the Lab, and the fixtures are invented.

One method point matters for readers. The module, like most parsers, returns an empty table with no error when a store is missing or unreadable. The Lab's earlier study of silent parser failures found that about 18 percent of the iOS artifacts of one open-source suite matched a file and returned nothing (LAB-TR-0006). Our module's notes therefore say which store each artifact needs, so that an empty result can be told apart from a store that was never there. LAB-0005 sets out the four states we use: present, absent, unreadable and cannot say.

What is on the device and what is not

Figure 2 follows a sale from search to rating and asks, at each step, what the service does and what the phone keeps. The right-hand column is short, and the later rows are empty.

Figure 3 lets you pick the kind of evidence you hope to find and see where it lives. Tags use words and shapes as well as colour.

Table 2 lists the seven artifacts the module produces, with the file or table each is read from, what it holds, its value and its limits.

Figure 4 shows how many rows the module read from each container. The counts are not comparable between artifacts, because a row means something different in each. They are comparable between the two builds, and they show the layout shifting: the feed store appears only in the newer build, and recent searches moved from a long list in the older to a single entry in the newer.

Several other files exist and are not read. The cache holds mostly advertising and analytics hosts. Other SQLite files belong to software development kits or to the system. A large catalogue of vehicle data sits in one overflow file and is not about the user. Image caches make up most of the container's files, and the module does not interpret them.

What an examiner can and cannot conclude

Can say, with the file and key named. The app was installed and run on this device, and signed in under an account number at some point. A given area was set as a search or posting area. Certain search terms were in the recent list when the image was taken. An unsent draft existed under a conversation key. The app ran in particular windows of time. It contacted OfferUp and realtime-provider endpoints.

Cannot say from the phone. That a listing existed, that two people messaged, that a meeting was agreed, where or when it took place, or that a sale happened. The container holds none of these, so their absence is "cannot say". A reader who writes "no messages found" without that qualifier reports the limit of the evidence as a fact about the person.

Where the rest is. Records of listings, conversations and arrangements are held by the service. How an investigator obtains them is a legal and procedural question outside this article, and the first step is to record that the phone could not answer it.

Take care with the weak signals. A search area is not the phone's position. An affinity identifier is not proof the person opened that listing. A timing window is not an action. Each is an indicator, consistent with use of the app, and does not prove who was using it or why.

What this does not prove

Sources

Every claim and number, with the publisher and date. Web pages were read on 6 November 2026 unless noted. The U.S. Attorney's Office pages for the Florida case could not be loaded by automated fetch and are not relied on. The OfferUp help-centre pages also could not be loaded, so company statements come from the pages listed. Numbers that could not be sourced were left out. LAB-TR-0006 is on Zenodo (doi:10.5281/zenodo.23717928).

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related

The OfferUp parser and its synthetic fixtures are in preparation for the open-source project and the Lab artifact repository. No pull request has been opened yet.