Greetings,
I have a locked iPhone in an investigation. I have full access to the Mac computer. I had a look around and found the following
library/messages/chat.db (empty)
library/Application Support/AddressBook/
library/Application Support/CallHistory (successfully decrypted)
library/Application Support/Itunes Backup (old unfortunately)
library/containers/com.apple. maps/data/library/maps/GeoHistory.mapsdata (encrypted?)
Many have been helpful, however I know there is more to find.
I am not very familiar with Mac computers and would like any tips I can find and possibly decrypt mapsdata.
Everything that can prove and disprove data usage/visited locations etc is of great use.
Identify and analyze the following files
Training.db
Snippets.db
(And the above files’ WAL files.
These two files can capture 3rd party email content and text message content.
Probably won't work but compile all the passwords that are stored (think keychain and chrome if installed) and see if a 4-6 digit number appears regularly.