The com.apple.identityservices.idstatuscache.plist is located at /var/mobile/Library/Preferences/com.apple.identityservices.idstatuscache.plist. This file is used by Apple to confirm the user’s credentials as it travels across Apple’s ESS (Enterprise Shared Services). This file stores so much information and it should be examined for every iOS device you come across. You will find account information, iCloud sync dates, metadata (email addresses, phone numbers) and a lookup date for each item. While content isn’t available, this file may provide keywords and clues that are invaluable to your investigation.

The screenshot on the right shows an example of the last LookupDate for FaceTime Audio. More research is required on this file, but the artifacts may provide hints on where to dive deeper in other files on the iOS device.

*Special thanks to Detective Chad Gish for
uncovering this incredible artifact!