Ever wonder how your device knows what is draining the battery? Yep, there are files to track that. Simple files like /Library/Preferences/com.apple.BatteryCenter.BatteryWidget.plist show if the user can see the battery icon. Other files like CurrentPowerLog.PLSQL will rock your investigation if you find an older backup or device. The number of artifacts found in the /private/var/containers/Shared/SystemGroup/<GUID>/Library/BatteryLife/CurrentPowerlog.PLSQL is astounding. This file provides us access to glimpses of user data that was draining the battery, supports application usage (even if deleted), how the data was used (Wi-Fi versus cellular), and potential timestamps that can link a user and an activity to the iOS device. Most tools support parsing of data from this file and a Full File System extraction is required to obtain it.

Sarah Edwards kicked off the research with her Bsides NOLA presentation. Check it out at https://for585.com/518. This file contains over 200 tables. Enjoy parsing that!