Thoughts From a Digital Forensic Practitioner
I have been quiet the past few months, but that does not mean I haven’t been busy. While working on a larger project I found myself getting really annoyed with timestamps. Because I was working on my Mac, I was having to run out to a website I have used for years for quick timestamp … Continue reading Timestamped →
If you are not familiar with Lost Apples, please read the original post before proceeding. There have been some interesting cases in the news lately that have caused me to give some thought about devices being in proximity to each other, and how to prove that proximity, especially when those who are intent on doing … Continue reading Old Dog, New Tricks – Lost Apples 2.0 →
Earlier this year I wrote a post about Observations.db, which is a component of Apple’s FindMy functionality. It was the second part of a post I had written in 2024 about rogue Bluetooth trackers and FindMy compatible devices on iOS devices. In short, FindMy data can offer examiners additional sources of location information along with … Continue reading Endtroducing…Lost Apples →
Note: This article assumes you have read a previous article about AirTags, found here, as it references items associated with iOS searchpartyd with little to no explanation. It is highly recommend you read the previous article before proceeding. Also, the data discussed here is also parsed by Lost Apples, which you can find here. Over … Continue reading Further Observations – More on iOS Search…
Another summer has flown by. Vacations, court (yes!), classes (also, yes!), and of course the conference circuit were (and still are) all in full effect this year. Things are winding down a little and I finally have a chance to put fingers to keyboard and write about some things I have had in the works. … Continue reading (Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing →
It is not often that I get to revisit previous research. Most, if not all, of us do research, share it (hopefully), and then move on to the next thing. There is so much to examine that it is nearly impossible to revisit things, especially in the mobile device space. When we do go back, … Continue reading Ridin’ With Apple CarPlay 2 →
While it wasn’t as “soon” as I would have liked, I am (finally) pleased to announce the availability of public images of iOS 16, Android 14, and iOS 17. A few notes. First, there are no Reader versions. I will revisit including them in the future, though. Second, there is no non-Cellebrite-extraction-structure version for the … Continue reading Triple Trouble. iOS 16, Android 14, and iOS 17 Images…
Note: this post is a quasi-continuation of my previous post about Bluetooth trackers on the Google Find My Device network. Also, there is a second part to this post which you can find here. Also, the files described in this post are now supported by Lost Apples, which you can find here. While I typically … Continue reading Where The Wild Tags Are & Other AirTag Stories. →
NOTE: portions of this post appeared in my presentation at the 2024 SANS DFIR Summit. Where did the summer go? August is almost behind us, but it seems like yesterday the kids got out of school here in the U.S. Conferences, work and vacations have a way of making the time fly. Back in May … Continue reading Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network →
Back in December of 2023 Google announced a change to Android’s Location History feature that got quite a bit of attention. Prior to the announcement, users could view their location history via the Google Maps application and any web browser where they were signed in. That meant the data was stored by and likely accessible … Continue reading The Green Look Back. Android’s On-Device Location…