Internet activity.
Start with all of the apps that are installed, but do not
forget Safari.
On an iPhone, Safari will always be used.
When the user clicks on a link in a third-party app,
if you click on-- let's say you click on a link in Instagram
to buy something.
It opens Safari.
If you click on a link in Facebook, it opens Safari.
If I text you something on your iPhone
and you click on the link, it's going to open in Safari.
Safari is always used.
I find myself to be a Chrome user.
However, Safari is always used.
So make sure you examine the database is of interest.
I would sort by row count for all of the browsers.
I would take a look in AXIOM and see
what AXIOM parsed, because AXIOM is really
strong at browser artifacts.
Or Physical Analyzer, or whatever tool you're using.
And start with the history.
From history, do you have what you need?
Or do you need to dive deeper and go into Bookmarks, Cache,
Cookies, possibly carved images, location searches,
all of these things?
On Section 5, I will dive deeply into internet activity.
But I can't dodge talking about it now,
because you're going to see it in your investigations.
Something else I want to warn you about.
I helped with an investigation where
Detective was working a case.
Unfortunately, a child was murdered,
and they think they know where the body was dumped.
But when they got the device of the suspect,
it showed that he was in Dallas, Texas.
They're like, there's no way.
He was in Georgia, where he dumped the body.
So when I looked at it, it was a Safari search hit
for Dallas Fort Worth airport.
Now, think about this.
When you search for an airport or restaurant,
the coordinates are there.
The tool is doing its job.
It went through Safari, it parsed the coordinates,
gave it a timestamp, and showed it.
Your investigations are as good as the person
behind the keyboard.
All the person had to do was look
at that source file and say, oh, this is a Google search.
That does not mean the user was at that location.
Now, that person who committed that murder
did search for Dallas Fort Worth airport on that day.
The tool simply carved out those coordinates and presented it
to you.
You need to validate and verify.