Which artifacts are commonly sought on iOS devices?

• A. Call logs, messages, contacts, app data
• B. Photos, keychain entries, plist files, backup metadata
• C. Browser history, system logs, and event logs
• D. GPS data, device location history, and hardware serials

Answer: (A)

On iOS devices, the most informative data for understanding user activity is the set that shows who the user communicated with, what was said, and with whom they connected. Call logs capture who was contacted, when, and for how long, creating a clear communication timeline. Messages preserve the actual content of conversations, including timestamps and participants, which helps establish sequence and corroborate other evidence. Contacts map out the user’s social network and link people to conversations and apps, enabling investigators to reconstruct relationships and contexts. App data from installed applications adds depth by revealing how accounts were used, what actions were taken, and how different apps were joined into the user’s daily routine. Together, these artifacts form a cohesive picture of the user’s interactions and activities on the device.

While other data types exist, they’re often less universally accessible or directly tied to personal interactions. Browser history, system logs, and event logs may be fragmented or require additional steps to access. Location data can have gaps and permissions hurdles, and photos or keychain data may be encrypted or stored separately. So, the combination of calls, messages, contacts, and app data is the most consistently informative set investigators seek on iOS devices.