Some examples here-- so let's look at how the tools are
actually parsing this.
On the left-hand screen, we see com.apple.wifi-networks.plist
and com.apple.wifi.known networks.plist.
Make sure your tool is actually parsing this information.
If not, go out and look at the networks yourself.
So when we look at this information,
we can actually see connections that the user had made.
So we can see where I was--
Marriott.
We can see Zermatt guest, Hyatt, Sunset Marina, Sanctuary Wi-Fi,
Savannah Dawn.
All of these locations could be leveraged to put you
in a certain location at a period in time.
So in this screenshot here, we can
see I connected to something called Chicago PD on 7/5/2021.
I was joined by the user at 12:31:37 PM.
Another file of interest, the WiFiNetworkStoreModel.sqlite--
we see ZGEOTAG and ZNETWORK.
We will have ZDATE, ZLATITUDE, ZLONGITUDE, ZBSSID.
You know this is from an Apple because the Z,
and we also see these Mac date time stamps.
En0.plist-- here we're looking at this in AXIOM.
And we can see down here, we have the IP address,
the date timestamp.
You're going to have information about those networks.
We can see that the user was connected
to something called WineLove.
That's my home Wi-Fi.