Quick, "Monday Morning Solutions" for those nagging forensics problems we run across.
TL;DR: A two-year retrospective on spending my COVID quarantine accidentally discovering a bevy of personally identifiable information published on the Internet due to someone forgetting to read the fine manual. 1 Overview I acquired COVID-19 in the fall of 2022 which was bad for two reasons: 1) I had COVID-19 and 2) I needed a project to kill five days of isolation. Text messages from my state’s…
TL;DR: How a leading service in its niche broke 5 of the OWASP Top-10 categories on just one page with one cookie.
TL;DR: iOS 18 brought far less changes to Apple Notes than many recent releases which is a good thing because I am way too delinquent on these posts. Three Years? While not directly related to the subject at hand, I feel it necessary first to explain a nearly three year gap in posts on this subject. These past three years were exceptionally hard from a personal perspective, starting with a family…
TL;DR: iOS 15 brought more forensics-meaningful changes to Apple Notes than recent major version releases. Structural Changes Between iOS 14.8 and iOS 15.0, Apple added the following 25 columns Apple Notes’ ZICCLOUDSYNCINGOBJECT table, bringing that massive table to 181 columns. This post will examine how each of those columns is used in the new features added to Apple Notes. ZACCOUNT5…
TL;DR: Week 12 of the #MagnetWeeklyCTF was a return to the browser that shalt not be named.
TL;DR: Week 11 of the #MagnetWeeklyCTF was a chance to check out rekall, mainly because I was completely fail-whaling on getting the relevant Volatility plugin to work.
TL;DR: Week 10 of the #MagnetWeeklyCTF was a healthy dose of humility towards the end of the questions.
TL;DR: Week 9 of the #MagnetWeeklyCTF began a new case, this one involving a memory image.
TL;DR: Week 8 of the #MagnetWeeklyCTF started down the side quest I was hoping to dig into, but only scratched the surface of my itch.
TL;DR: Week 7 of the #MagnetWeeklyCTF tests your knowledge of the presence of a single file on a Linux machine.