Poisoned Apples – How Do We Find Them?

*Executive summary:* This talk summarizes practical, repeatable methods for creating iOS forensic artifacts—primarily encrypted iTunes backups and sysdiagnose captures—to preserve crash logs, process lists, app/file metadata, and network data that help investigators detect known or unknown spyware, and it outlines step-by-step procedures plus the scalability and tooling challenges organizations face when applying these methods across device fleets.