For Wi-Fi, we have many files of interest.
So let's look at all devices versus jailbroken.
Now, something I want to point out
at this part of the course--
if you see anything that's in italics,
it means it requires a jailbreak or a full file system
to get access to that.
If it is not in italics, you should get it even
with an encrypted iTunes backup.
So here we're looking at com.apple.Wi Fi.known
networks.plist.
We see com.apple.wifi.plist.
We see com.apple.prefer ences.network.plist.
These are all going to track Wi-Fi connections
on the device.
Now, that last one, com.apple.prefer
ences.network.plist, is going to track if airplane mode is
currently enabled or not.
What's awesome is, when we can tell the airplane mode was
turned on, turned off, when people left areas of interest,
it will help prove or disprove that someone was out
of location when something occurred.
When we look at jailbroken devices, we have en0.plist.
That is helpful.
We also com.apple.wifian alyticsd/DeviceA
nalyticsModel.sqlite.
We are going to have the com.apple.commcenter.device
specific nobackup.plist and WiFiNetworkStoreModel.sqlite.
So we have all of these files that are of interest to us.