Apple Continuity-- this is when Apple allows
us to be very lazy humans.
And you have to be careful with this.
You can essentially start something on one device
and hand it off to another.
So that same example, if I get up and I leave the studio--
if I answer a FaceTime call on my watch,
I could then come into the studio
again, sit in front of my computer,
and continue that FaceTime call.
What is that going to look like?
You are going to see, however the communication
was established, it's going to look like it
happened on that device.
The fact that I could pay for something
on my Mac from my watch--
it's insanity.
The more we are able to just bounce back and forth
between devices, the harder it makes for forensic examination.
What I strongly recommend is, if a Mac is involved,
that is going to have the most information for you.
So start there.
You have the best event logs.
If you can get a full file system
extraction of an iPhone, which we're going to talk about,
you will also have a lot of event logs
that you could look at to see what actually occurred.
Now, the watch-- there are ways to actually acquire a watch,
and we are going to talk about that,
but the watch data's automatically
backed up to your phone.