Other databases of interest before you
hit the second part of this lab.
Recent communications.
You're going to have a Recents directory
and then a file called Recents.
Again, make sure you verify this.
In some of my recent communications,
I've seen people in it that have been copied on messages.
So be careful with that.
If you want to look at voicemail,
that's in voicemail.db.
Passes.
Passes are a great way to get a glimpse of what
the user is up to.
Think of flight information, concerts, any venues
that the person is going to.
All of these things could be stored in passes.sqlite.
Bluetooth is extremely important.
I wrote an article, a whitepaper,
with Matt Gecko, one of my coworkers.
And we won forensic article of the year
at the deeper forensic forecasts.
It was on Bluetooth.
The research took three years to write that paper.
And I'm going to let you struggle a little bit
in the lab before I talk about the ins and outs of this paper.
But you may want to read the paper before you do the lab,
because you're going to answer questions on Bluetooth.
And you will see the link to it in the notes of the book.
And I think we called it Using iOS Bluetooth to Solve Crimes
Faster.
But you're going to see, there are several databases.
Com.apple.Mobile .Bluetooth.ledevices.other.
Those are the Bluetooth devices the phone has seen.
This is the file that I actually, in that Delphi
murders, I wanted to see if they looked at this file
to see if, possibly, Libby's phone had
pinged the potential killer.
Because what if it pinged--
I did not kill them.
But if it pinged my device, it would
say Heather Mihalik's iPhone.
That's a huge indication of who that person would be.
ledevices are current pairing.
So if you look at my ledevices paired,
it's going to show that I'm currently paired to my Apple
Watch, I'm possibly paired to my Mac,
if I'm paired to anything else-- my AirPods.
Mobile Bluetooth devices are also going to track pairings.
So these are three files you need to look at.
For calendar, calendar.sqlite, extras.db, and notifications.ca
lendar.protected.
These are three things you want to examine.
For accounts, it's going to be an accounts3.sqlite.
And then there's another aggregated dictionary
that could be helpful with some passwords and things
that you may find useful in your investigation
under ADDataStore.sqlitedb.