Clik here to view.
Knowledge is Power II – A Day in the Life of My iPhone using knowledgeC.db
iOS devices may potentially have more personal information and user patterns than their macOS counterparts. People tend to go about their daily lives with their mobile devices rarely being separated...
View ArticleVideo Now Available - #DFIRFIT or BUST: A Forensic Exploration of iOS Health...
Heather Mahalik and my presentation of the iOS Health Database from the DFIR SANS Summit this past summer is now up. As always you can find the link to all my presentations, videos, and other resources...
View ArticleSlides and Script! From Apple Seeds to Apple Pie & Introducing APOLLO: The...
I had the privilege and honor to present at the first ever Objective by the Sea Mac Security Conference yesterday in Maui (hardship, right?). It was only the first day and it was absolutely...
View ArticleClik here to view.
Do it Live! Dynamic iOS Forensic Testing
Testing and forensics go hand in hand. You cannot be sure about a certain artifact on what it contains or what certain pieces mean without testing (and not just once, but over and over and on multiple...
View ArticleClik here to view.
AirDrop Analysis of the UDP (Unsolicited Dick Pic)
I saw this article “NYC plans to make AirDropping dick pics a crime” on Friday and it got me thinking. What exactly are the cops going to find if they do an analysis of a device, either the sender or...
View ArticleClik here to view.
On the First Day of APOLLO, My True Love Gave to Me - A Python Script – An...
I originally released APOLLO at the Objective by the Sea conference in early November. Since then I’ve received a surprising amount of positive feedback about various analysts using this tool or the...
View ArticleClik here to view.
On the Second Day of APOLLO, My True Love Gave to Me - Holiday Treats and a...
The iOS Health database may be the easiest database to acquire. While other databases need physical file system dumps of the devices, this database can be accessed with an encrypted iOS backup, or...
View ArticleClik here to view.
On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to...
On this third day, we will focus on application usage. We will cover three databases:KnowledgeC.dbBe sure to check out more detailed information on this database in my two previous articles.Access to...
View ArticleClik here to view.
On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to...
The fourth day brings us media artifacts using the knowledgeC.db and CurrentPowerlog.PLSQL databases. Each database stores similar yet somewhat different records when it comes to audio, and video...
View ArticleClik here to view.
On the Fifth Day of APOLLO, My True Love Gave to Me – A Stocking Full of...
Today we go over one of the stranger databases on iOS, the Aggregate Dictionary database, or ADDataStore.sqlitedb. This database is only available with a physical file system dump in the...
View ArticleClik here to view.
On the Sixth Day of APOLLO, My True Love Gave to Me – Blinky Things with...
On this sixth day we’re going to go back to looking at the knowledgeC.db and CurrentPowerlog.PLSQL databases. If you are unfamiliar with these databases, please go back a few blogs. Today is all about...
View ArticleClik here to view.
On the Seventh Day of APOLLO, My True Love Gave to Me – A Good Conversation –...
Today is all about the CurrentPowerlog.PLSQL database. This database keeps track of many ways that data is transferred either by cellular, Wi-Fi, or Bluetooth methods. These modules can help determine...
View ArticleClik here to view.
On the Eighth Day of APOLLO, My True Love Gave to Me – A Glorious Lightshow –...
Today we’ll be analyzing the knowledgeC.db and CurrentPowerlog.PLSQL database for various connections. The first thing you may want to know in an investigation is – was the device plugged in or not?...
View ArticleClik here to view.
On the Ninth Day of APOLLO, My True Love Gave to Me – A Beautiful Portrait –...
The interface of the device can produce some useful artifacts. Starting with screen orientation. Perhaps you want to know if the user was watching a video for a period of time. In conjunction with...
View ArticleClik here to view.
On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map...
I saved one of my favorite topics for (nearly) last. There is no question that location can play a major role in many investigations. iOS location data as changed drastically with iOS 11 from previous...
View ArticleClik here to view.
On the Eleventh Day of APOLLO, My True Love Gave to Me – An Intriguing Story...
I did a blog article, especially about the knowledgeC.db about a day in the life of my iPhone and it went over really well. I’ve decided to do a similar story using all the data that I’ve parsed from...
View ArticleOn the Twelfth Day of APOLLO, My True Love Gave to Me – A To Do List – Twelve...
My Christmas gift to you - improvements!More Queries – There is plenty more to come. There are more databases and many half-written queries that I have yet to add.Additional Testing – I want these to...
View ArticleVideo of 'From Apple Seeds to Apple Pie' from Objective by the Sea - Now...
Videos have been posted from Objective by the Sea from this past November. My talk ‘From Apple Seeds to Apple Pie’ a pattern of life talk about my APOLLO tools is here.As always, my videos and...
View ArticleClik here to view.
Network and Application Usage using netusage.sqlite & DataUsage.sqlite iOS...
Two iOS databases that I’ve always found interesting (and probably should test more) are netusage.sqlite and DataUsage.sqlite. These two databases contain very similar information – one is available in...
View ArticleClik here to view.
Apple Pattern of Life Lazy Output’er (APOLLO) Updates & 40 New Modules...
I started filling in the gaps to missing APOLLO modules. While doing this I realized there was some capability that was missing with the current script that had to be updated. As far as script updates...
View Article