Page 1
IOSKNOWLEDGE & BIOME · A GUIDE FOR UK LAWYERS iOS Knowledge and Biome: The Device Activity Record The Phone's Own Diary of What Was Done, and Why It Must Be Read by an Expert COMPUTER FORENSICS LAB
§ ABOUT THE AUTHOR PREPARED BY COMPUTER FORENSICS LAB E-DISCOVERY TEAM DEVICE-ACTIVIT Y RECONSTRUCTION CPR PART 35 EXPERT REPORT S FULL CHAIN-OF-CUSTODY DOCUMENTATION
§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: the phone keeps a diary 03 What the iOS activity databases record 04 Reconstructing the device-activity timeline 05 Why expert interpretation is essential 06 Log rotation, corroboration and honest limits 07 Deployment: proving what the device was doing 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist
§ 01 · ORIENTATION Executive summary The headline point: an iPhone keeps a fine-grained diary of its own use in internal databases such as Knowledge C and Biome, recording which apps were used and when, screen and lock state, notifications and connections, a powerful source for reconstructing user activity, but cryptic, specialist to interpret, and subject to ageing out.
§ 02 · FIRST PRINCIPLES The problem in plain English: the phone keeps a diary
§ 03 · WHATTHEYRECORD What the iOS activity databases record APP USAGE SCREEN / LOCK NOTIFICATIONS CONNECTIONS TIMELINE
Page 2
§ 04 · THEACTIVITYTIMELINE Reconstructing the device-activity timeline
§ 05 · EXPERTINTERPRETATION Why expert interpretation is essential
§ 06 · ROTATIONANDHONESTLIMITS Log rotation, corroboration and honest limits
§ 07 · DEPLOYMENT Deployment: proving what the device was doing
§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE MAC / PHONE LIVE ACTIVIT Y BACKUPS / APFS AGED-OUT / DATABASES ICLOUD SNAPSHOTS RECOVERABLE PAIRED OTHER IPAD DATA
§ 09 · IN THE WILD Worked examples EXAMPLE1 · THEDIARYTHATSHOWEDTHEPHONEWASINUSE EXAMPLE2 · THECRYPTICFIELDTHATWASNEARLYMISREAD EXAMPLE3 · THEGAPTHATWASROTATION, ANDTHEBACKUPTHATFILLEDIT
Page 3
§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations
§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTION FOR AN AC TIVITY- DATABASE ANALYSIS
§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic The activity-database checklist Red flags When to involve a digital forensic expert
§ 13 · COMMON QUESTIONS Frequently asked questions What are Knowledge C and Biome? What can these databases show? Why do these need an expert to interpret? If there are no activity records for a period, does that prove nothing happened? How reliable is this evidence? How urgent is preserving the phone for this?
§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER
§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY
Cite as: Joseph Naghdi, IOS Knowledge And Biome The Device Activity Record, Computer Forensics Lab, https://e-discovery.uk/library/ios-knowledge-and-biome-the-device-activity-record/pdf.