The Apple Watch
Examining the Apple Watch is new and exciting. The good news is that the files found on the watch are similar, if not the same as those found on the iPhone. We are going to see the data primarily existing in the SQLite database and plist files, and this is examined by creating or examining an iPhone backup file. Remember that an iPhone running iOS 8.2 or later is the only iOS device capable of being linked to the Apple Watch.
One unique aspect about the Apple Watch is that the data pertaining to the watch is stored in the mobile/Library/DeviceRegistry
directory within the backup, which is shown in the following screenshot:
Here, you will find exact copies of files found on the iPhone. If the case relies upon determining what happened on the Apple Watch versus the iPhone, it may be impossible to solve. As of Watch 2.0, the files that are used by both the iPhone and the watch are exact copies of one another, and they do not contain status flags stating...