Authors: Scott Koenig (Nevada State Police)

DFRWS USA 2022

Abstract

Most iPhone users interact with their device without thinking twice about how they locked and unlocked their device and in some instances the device might auto-lock. Users might not really pay attention to these user and device actions, but to a forensic examiner these settings and user actions could be very valuable to an investigation. During this talk, audience will be informed about a property list (plist) that stores some device settings and where this property list can be located during a forensic examination: \private\var\mobile\Library\UserConfigurationProfiles\PublicInfo\PublicEffectiveUserSettings.plist. The audience will be shown several examples so they can be confident in their decoding of the data stored in the property list.

Read the DFIR Review publication.

Watch the Youtube Video.

Downloads