Authors: Scott Koenig (Nevada State Police)
DFRWS USA 2022
Abstract
Most iPhone users interact with their device without thinking twice about how they locked and unlocked their device and in some instances the device might auto-lock. Users might not really pay attention to these user and device actions, but to a forensic examiner these settings and user actions could be very valuable to an investigation. During this talk, audience will be informed about a property list (plist) that stores some device settings and where this property list can be located during a forensic examination: \private\var\mobile\Library\
Read the DFIR Review publication.