Preference files matter.
And I realize there's a lot of information on this slide.
Definitely leverage your cheat sheet.
But things that we want to show. com.apple.accounts.exists.plist.
This is going to track different accounts that
exist on the device.
Any time you see Library/DataAccess, that
is strictly related to email.
Library/DataAccess is reserved for email
that's syncing to the device.
If you look at my device, I stopped
working at Basis Technology, I think, in 2015?
Maybe 2013.
When I even do an iTunes encrypted backup,
it still shows heathermihalik@basistech.com,
heathermihalik@mantech.com, heathermihalik@cellebrite.
It's all of the emails that ever synced to your device.
It will remember them.
If the person deletes their email
or turns it off or disables it, you
will still see that trace that something
was happening on that device.
Other things I want you to examine.
And this depends on what your investigation is about.
com.apple.locationd.plist.
Remember, if it's 0, 1, or true, location services are enabled.
com.apple.homesharing.
So this is going to say iCloud sharing information
if you're sharing it with different devices.
Very important. com.apple.assist ant.backedup.plist,
your iCloud sync Settings.
Com.apple.coreduetd.plist, all of your synced devices.
So if you look at mine, it would show my watch,
it would show my iPad, it would show my Mac,
it would show my children's iPads.
Any time you see these magic words right here--
nano or registry-- it's associated with an Apple watch.
commcenter.plist.
We talked about this a little bit for SIM cards.
But it's also going to store the IMEI, the phone
number, and other information.
Com.apple.MobileSMS.plist.
Days to keep SMS.
Remember, if it's iOS 13 or below,
if there's no value, no results, it's
because it's set to forever.
If it's 14 or 15, it would be a value
of 0, which means forever as the default. Otherwise,
it would be the number for how many days.
Com.apple.identi tyservice.idstatuscache.
We're going to take a look at this file coming up.
It's snippets of your contacts and your phone numbers.
The point of this file--
any time you try to communicate with someone,
Apple wants to know if you're attempting to communicate
with another Apple user.
The reason-- can you FaceTime?
Can you iMessage?
How is the conversation supposed to go through?
So what you could say by looking at that file is,
the user attempted to communicate
with Party X at this time.
That's all you can say.
You cannot say if the communication actually
occurred.
And the reason I'm telling you this.
What if I try to FaceTime an Android user?
It will look it up and be like, no, this isn't possible.
They don't have the FaceTime app installed.
So these are things that could be of interest to you,
but make sure you don't say 100% that something
happened on that date and time.
And then finally, accountsettings.plist.
This is going to have all email accounts that
are pushed to that device.