CarPlay is Apple's attempt to make driving your car and using your phone at the same time safer. In order to do this, Apple has basically created a screen mirroring service which allows for your in-car infotainment system to stream data from your mobile device. This is great for listening to your favorite podcasts and use Siri to send/receive messages while driving. There's been some great research done previously on CarPlay and forensics including the talk by Heather Mahalik and Sarah Edwards which is available here (slides here) as well as Josh Hickman's take on the topic available here.
Without rehashing the CarPlay artifacts that haven't really changed, this post is going to focus on the artifacts that have changed with iOS 16. Most of the plist files from the /private/var/mobile/Library/Preferences directory are still there and full of data. The biggest change when it comes to CarPlay is where we used to search for "carplay/isConnected" in the KnowledgeC database, those entries are no longer present. Instead, which you probably surmised from the title of this post, the data can be found within the Biome directories.
Looking into the biome data there's a couple of places you can find CarPlay information. One of those places is the directory private\var\mobile\Library\Biome\streams\restricted\_DKEvent.Carplay.IsConnected\
Pulling apart this SEGB file (which for more information about them go back to Part 1 here) reveals protobufs that contain information about when CarPlay is connected or disconnected.
CarPlay Red Herring
There's also a CarPlay folder within the biome directory under private\var\mobile\Library\Biome\streams\public\CarPlay\. The biome here doesn't tell much as each protobuf only contains two values. The first value will reflect a 0 or a 1, and the second value always a 0 in my testing. There are no timestamps or other identifiers within this data. The protobuf record header within the SEGB file does contain two 8 byte Apple timestamps but they didn't line up with events within my test evidence directly so are likely more related to when they are written.
Another KnowledgeC event "/inferred/motion" has made its way over to the biome data found within the directory private/var/mobile/Library/Biome/streams/restricted/_DKEvent.Inferred.Motion/. When parsing the protobufs stored within, its fairly familiar to others in the CarPlay family.