The release of the Apple Watch Series 3 had us hoping that the device would finally track calls that were made from the watch, while acting independently from the iPhone. This is not the case and still isn’t with the latest release. All of the calls I made from my Apple Watch were placed right into my callhistory.storedata with the rest of the calls. Worse yet, there isn’t a status flag stating where the call was made. This makes putting a person behind a device extremely difficult.

When examining artifacts from the latest Apple Watch, we see that the files of interest still exist in /var/mobile/Library/DeviceRegistry/<GUID> but are primarily plist and dat file. Apple watch data also exists in /mobile/Library/NanoBackup.  You will find a few databases, and those should be examined for relevance.

A tip for iOS examinations, if you see the words “nano” or “DeviceRegistry” an Apple watch is involved.