We have now looked at, was an app used,
and where a person was when an app was used.
Can we prove it happened on that device
and was not syncing from something else?
So the first thing we want to do is
go to preferences.plist for system configuration.
How is the device you're examining set up?
We want to leverage interactionC.
InteractionC you actually can get from an advanced logical
or backup if and only if you encrypt it.
Another important thing here.
If you don't encrypt it, you're not
going to get access to that.
We're going to look at interactionC here in a minute.
netusage.sqlite requires a full file system extraction.
That com.apple.identi tyservices.idstatuscache,
this is the file that is that Apple ESS lookup that says,
are you dealing with another Apple user or not?
com.apple.networ kidentification.plist
is identifying all of the networks.
And then there's so much more.
So use your cheat sheet.
Dig deeply into this.
Look at knowledgeC.
Look at all of the other files of interest.