The files listed above are all included on your cheat sheet. We are going to be examining some of these in the labs, and you will find many of them to be useful. Keep an eye out for a blog on Smarterforensics.com on the most helpful plists and why.

  •  /preferences/SystemConfiguration/com.apple.accounts.exists.plist: Account information

  •  /Library/DataAccess/AccountInformation.plist: Email Sync information

  •  /Lockdown/device_values.plist: Tons of info—EXAMINE THIS FILE—Activated State, Bluetooth address, and more

  •  /Library/Preferences/

  •  com.apple.locationd.plist: If 0x01, location services is enabled

  •  com.apple.homesharing.plist: iCloud sharing information

  •  com.apple.assistant.backedup.plist: iCloud sync settings

  •  com.apple.coreduetd.plist: Synced devices

  •  com.apple.NanoRegistry.plist: Apple Watch information

  •  com.apple.commcenter.plist: Device Info (IMEI, Phone Number, SIM/eSIM, etc.)

  •  com.apple.MobileSMS.plist: Days to keep SMS

  •  com.apple.identityservices.idstatuscache.plist: Snippets of contacts, phone numbers, etc.

  •  com.apple.accountsettings.plist: Email accounts pushed to device

Caution: You may need Method 2 to pull some of these files via Physical Analyzer.