The release of the Apple Watch Series 3 had us hoping that the device would finally track calls that were made from the watch, while acting independently from the iPhone. This is not the case and still isn�t with the latest release. All of the calls I made from my Apple Watch were placed right into my callhistory.storedata with the rest of the calls. Worse yet, there isn�t a status flag stating where the call was made. This makes putting a person behind a device extremely difficult.

When examining artifacts from the latest Apple Watch, we see that the files of interest still exist in /var/mobile/Library/DeviceRegistry/<GUID> but are primarily plist and dat file. Apple watch data also exists in /mobile/Library/NanoBackup.� You will find a few databases, and those should be examined for relevance.

A tip for iOS examinations, if you see the words �nano� or �DeviceRegistry� an Apple watch is involved.