Page 1

APPLEWATCH & PAIREDDEVICES · A GUIDE FOR UK LAWYERS Apple Watch and Paired-Device Forensics The Device on the Wrist: Stronger Attribution, Its Own Data, and a Wider Estate to Examine COMPUTER FORENSICS LAB

§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM ESTABLISHED 2007 · LONDON ISO 17025-ALIGNED PROCEDURES APPLE WATCH FORENSICS ATTRIBUTION & PAIRED-DEVICE ESTATE CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the device on the wrist 03 What the Apple Watch records 04 Stronger attribution: worn, not carried 05 Acquisition and the paired estate 06 Interpretation and honest limits 07 Deployment: the wrist and the wider estate 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary some recorded independently of the phone, and its place in a paired estate that shares and corroborates much of the same evidence.

§ 02 · FIRST PRINCIPLES The problem in plain English: the device on the wrist

§ 03 · WHATITRECORDS What the Apple Watch records HEALTH / MOTION MESSAGES APP DATA LOCATION PAIRED ESTATE