Your best practices for iOS analysis.
You must encrypt all extractions for iOS 13 through 15.
I realize we have not covered backup files yet.
That is coming in Section 4.
Always assume the user upgraded their version, which
means you don't want to get tunnel vision like a tool.
If you see iOS 15 on my device, you're
also going to see a lot of historical information,
because I always continue with the same iCloud account
and I always restore my data.
Assume the user upgrades third-party apps.
And the main reason I want to tell you this--
it is consistent on Apple devices
that databases or columns could change.
It doesn't mean the old database for that app will go away.
Verify your timeline.
If it doesn't make sense, if something seems off,
maybe it's coming from a synced device.
So verify the sync settings.
Consider data retention.
When you're hunting deleted items,
know that Apple does vacuum the databases.
Consider what iCloud Settings are enabled.
Consider how long the user is intending
to keep things like messages.
Be ready to find the databases.
Be ready to look for a plist.
If you want to find all of the chunks of plists
in Physical Analyzer, if we go back into the VM
and we go into Analyze Data and we scroll down,
we have already looked several times at the databases.
If you go to configurations--
and I hope this doesn't crash.
It's 154,000 files.
These configurations are going to be your plist.
You could then sort by plist and start keyword
searching for any that are on your cheat sheet
that you deem relevant enough to examine.