something about digital forensics and something not
Following my recent research into Apple's Biome ecosystem, I continued examining additional artifacts located within the DuetExpertCenter framework. Although much of the recent forensic attention has focused on the SEGB file format and, in particular, on the notification-related streams located within: /private/var/mobile/Library/DuetExpertCenter/streams/ it seemed reasonable to assume that…
Following my previous article, 84 Streams Later: Exploring the Evolution of Apple Biome , this article takes a deeper look at the work performed during the analysis, with the goal of enabling further research into the various Biome streams identified throughout the investigation. As described in the previous post, on iOS 17 and later systems, Biome streams are primarily stored in two locations:…
Over the last few years, Apple's Biome framework has quietly evolved into one of the most important sources of forensic evidence available on iOS devices. While the forensic community has traditionally focused on artifacts such as KnowledgeC.db , Apple has progressively shifted a significant amount of behavioral, contextual, and predictive information into Biome. Today, most forensic analysts are…
I spend a lot of time analyzing Android devices and can process data using a variety of tools, both commercial and open source. As is well known, only by using multiple tools can one minimize errors, validate results across tools, and cover a greater number of artifacts, since each tool processes different files with different methods. During these analyses, I noticed that many SQLite databases…
Following the previous post dedicated to Android devices , this article outlines the data available on iOS devices, depending on the different forensic acquisitions that can be made. The objective is not to propose dedicated guidelines, but to provide a comparison between the data present within different acquisitions that can be obtained from an iOS device, analyzing the specificities of Apple's…
When I first started working in Digital Forensics, one of the fundamental principles was to always create a bit‑by‑bit copy of the storage device . Back then, we typically dealt with hard drives (internal and external), memory cards, and optical media. The choices to be made—then as now—revolved around how to access the device, giving rise to the concept of order of volatility . Simply put, this…
This has been a tough year for me: my mom passed away in June, and I'm still slowly recovering from the hard blow. It's time to start again doing what I love: researching and sharing! It's early September and like every year, that moment is approaching when everyone who deals with mobile forensics starts to tremble at the thought of the arrival of a new version of iOS! First the good news: the…
A smartphone is often connected to a Wi-Fi network: think of how much time we spend at home, in our office, or even in a public place while studying or exercising. As soon as we can reach a (hopefully trusted) Wi-Fi network, we connect to it! On Android devices, the Wi-Fi connection is managed by the Wi-Fi service. This service must store information about the previously connected Wi-Fi networks…
Android 14 was released to the public by the Open Handset Alliance on October 4, 2023, and is now available on various smartphones, including the Google Pixel. This blog post aims to explore a list of the majr oartifacts you can find on this version of the Android OS. For testing and review, I set up a Google Pixel 7A and used it for about a month, with a SIM card and various native and…
During the forensic examination of a smartphone, we sometimes need to understand some basic settings of the device. Some simple examples are: What is the name of the device? Is the "Set time automatically" option on or off? Is the "Set time zone automatically" option on or off? Is mobile data switched on or off? Is mobile data roaming switched on or off? On Android devices, most of these settings…
A common question during a forensic investigation of a digital device is: " Has the user ever used the XYZ application? ". As always when answering this question, it is important to create and follow a solid process. In this blog post, I want to share a possible process that everyone should customize based on their needs and roles. The ability to answer the question depends on the acquisition that…
The fifth episode is dedicated to three categories of third-party apps: browsers, mail clients, and productivity apps. There are 6 browsers, 3 mail clients, and 3 productivity applications available in Josh Hickman’s acquisition. The 6 browsers are listed below, in alphabetical order. Brave DuckDuckGo Firefox Firefox Focus Google Chrome Microsoft Edge The 3 mail clients are listed below, in…