Page 1
APPLEWATCH & PAIREDDEVICES · A GUIDE FOR UK LAWYERS Apple Watch and Paired-Device Forensics The Device on the Wrist: Stronger Attribution, Its Own Data, and a Wider Estate to Examine COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES APPLE WATCH FORENSICS ATTRIBUTION & PAIRED-DEVICE ESTATE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the device on the wrist 03 What the Apple Watch records 04 Stronger attribution: worn, not carried 05 Acquisition and the paired estate 06 Interpretation and honest limits 07 Deployment: the wrist and the wider estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary some recorded independently of the phone, and its place in a paired estate that shares and corroborates much of the same evidence.
§ 02 · FIRST PRINCIPLES The problem in plain English: the device on the wrist
§ 03 · WHATITRECORDS What the Apple Watch records HEALTH / MOTION MESSAGES APP DATA LOCATION PAIRED ESTATE
Page 2
§ 04 · STRONGERATTRIBUTION Stronger attribution: worn, not carried
§ 05 · ACQUISITIONANDTHEESTATE Acquisition and the paired estate
§ 06 · INTERPRETATIONANDHONESTLIMITS Interpretation and honest limits
§ 07 · DEPLOYMENT Deployment: the wrist and the wider estate
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE APPLE PAIRED ICLOUD / IPAD / ATTRIBUTION FALLBACK IF WATCH IPHONE BACKUPS MAC STRENGTH PHONE GONE
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEWRISTTHATSTRENGTHENEDATTRIBUTION EXAMPLE2 · THEWATCHTHATHELDWHATTHEWIPEDPHONEDIDNOT EXAMPLE3 · THEGAPTHATWASAWATCHOFFTHEWRIST
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The Watch and paired-device checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions Why examine the Apple Watch as well as the phone? Does the Watch prove who was doing something? Can the Watch help if the phone is gone? Is Watch health data reliable evidence? If there's no Watch data for a period, was the person inactive? How does the paired estate help corroborate evidence?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, Apple Watch And Paired Device Forensics, Computer Forensics Lab, https://e-discovery.uk/library/apple-watch-and-paired-device-forensics/pdf.