There is a plethora of Apple's iOS-based devices on the market. From a forensics standpoint, our learning curve as examiners has increased in our handling of these devices over the years. To that end, I have collected personal notes as I have dealt with these devices as I am sure most forensicators have. I recently decided to compile all of my notes into a single place and build upon the work that I observed that was recently compiled by Dylan and referenced by Heather Mahalik on her SmarterForensics blog. If you conduct forensics on iPhones or iPads, hopefully you'll find this reference chart useful
Feedback is welcome (especially if you find errors) and if you would like to see other information tracked, please let me know.
Great work, thank you! iOS is fine, did you consider to add OSX, tvOS and watchOS to include? These surounding devices are maybe helpful as device-to-device sync was enabled. Which tools fit best for which device or kind of data also could be worth thinking
OSX is its own herculean beast of artifacts and there are some better projects out there that document the DB and .plist artifacts of interest throughout the operating system.
I will look into my notes on watchOS, since this is an iOS variant, and see what could be potentially added. Good idea - thank you.