Pocket Litter - A Peek Inside Your Apple Wallet

Sarah Edwards, a digital forensics researcher, walks through the data Apple Wallet keeps on Apple devices and why that data matters in investigations. She starts by separating the related terms: Wallet is the app, Apple Pay is the payment technology, Apple Cash is a digital debit option, and Apple Card is the credit product. She then explains where passes such as tickets, boarding passes and loyalty cards live, how each one is packaged as a directory with a JSON file holding its details, and how iCloud can sync them to other devices.

The core of the talk is a large SQLite database that holds payment cards, Apple Cash peer payments, daily cash rewards, transit taps and Apple Card transactions. She shows how timestamps, merchant records and location tables can be joined to rebuild a timeline of a person's spending and movements, and how those results can be cross-checked against messages or emailed receipts. She notes that full card numbers are not stored, while the schema itself is hard to read, with many opaque table and column names that have to be worked out through testing.

She closes with sync behavior: Apple Card transactions spread widely across devices, while other card transactions tend to remain on the device where they were made, and transit data is kept per device. Practitioners should expect access to depend on backups, full file system extractions and device encryption, and should treat these stores as a rich source of personal context.