Placing the device at the scene of the crime.
You need to remember the cheat sheet that I provided to you.
So if we take a look at your Dropbox, and if we go into--
more so than just the iOS cheat sheet, which you can definitely
use, and you should.
But if we go into day three, we have location artifacts.
These location artifacts, remember the colorization.
It is going to tell you, can you trust this file?
How reliable is it?
Which table can you rely upon?
As we start looking, we can see, OK, these are reliable.
It looks like cache.sqlite and local.sqlite
are extremely reliable.
Photos is reliable.
And then everything else is kind of questionable,
except we have this one down here, this event cache.
And then we have the Find My iPhone
logs and Find My AirTags.
Those are reliable.
But things-- ThreeBars.sqlite, completely unreliable.
availability.db, cache_encryptedB, not reliable.
So make sure you reference this before you dive in too deeply
and trying to prove someone was out of location
if it does not matter at all.
You see a lot of italics on this slide.
So other than photos.sqlite, which we've already examined,
you are going to need a full file system
extraction to get the rest.
Cache.sqlite.
It includes searches.
It includes how fast you're driving in your vehicle.
It includes so much information.
It is a good file to start with.
The locations are accurate.
The time stamps are accurate.
Local.sqlite.
Significant locations and where you park your vehicle.
Also, very accurate.
Cloud-V2.sqlite.
Additional SQL or significant locations.
The CLSPublicEventCache.sqlite.
Now, this is only going to exist if you query events.
So if you're looking for concerts, maybe the Super Bowl
tickets, anything like that, if you're querying nearby sporting
events, that is going to go into CLSPublicEventCache.sqlite.
And then the final one is photosgraph.kgdb.
This is your photo analytics.
If it's going to be tracking, is it a tree?
Is it an animal?
Is it a person?
Is it a child?
It guesses the age.
It's insane what you can get from these files.