Proving that a device was in use may aid in your investigation. Obviously, you can search for powering events, determine if the device was unlocked, see if any activity was synching or updated, search for application and browser activity, and even see the last time it was booted. Some of these artifacts will require a full file system extraction. You should be able to dig far enough into the evidence that you can determine device usage. As always, refer to your cheat sheet for more information. There are so many artifacts left behind. Remember, every contact leaves a trace.

The file /Library/CoreDuet/People/interactionC.db shows datetimes (both start and end), application used, sender (if relevant), and more. This file is parsed by most tools and associated to the activity in question.

/private/var/networkd/db/netusage.sqlite

Table of interest:

znetworkattachmentzkind 1 is Wi-Fi, 2 is Cellular.

• A sampling of files that prove device activity include:

• /SystemConfiguration/preferences.plist

• /Library/CoreDuet/coreduetd.db: lock/device passcode

• /Library/Preferences/com.apple.identityservices.idstatuscache.plist

• /preferences/SystemConfiguration/com.apple.networkidentification.plist

• /Library/Preferences/

• com.apple.aggregated.plist (Last boot time—not necessarily last time used!)

• com.apple.contacts.donation-agent.plist (last metrics attempt datetime)

• com.apple.contextstored.plist (activity throttling dates)