Heather Mahalik and I presented on Apple Continuity artifacts at the SANS DFIR Summit. This is one of my favorite conferences of the year. I always have a good time reconnecting with old friends and meeting new ones! This year was no different. I look forward to it every year. It is my DFIR summer camp.
Slides can be found here!
This research is ongoing - we're adding in network artifacts from Phil Hagen! We will present it at future conferences (SANS SANSFIRE, CDI, and Network Security).