iOS 12 APOLLO Updates
Many modules were updated to specially support iOS 12 including those below. Many were already available on iOS 12 (Powerlog, Passes, SMS, etc). If the files are were available without a jailbreak. As...
View ArticleNew Presentation from Objective by the Sea 2.0 - Watching the Watchers
Just got back from a wonderful time hanging out with the who’s who of Mac security folk in swanky Monaco at the Objective by the Sea conference. I’ve uploaded my presentation Watching the Watchers in...
View ArticleClik here to view.
New Presentation from MacDevOpsYVR 2019 - Launching APOLLO: Creating a Simple...
I had the pleasure last week to attend MacDevOpsYVR in Vancouver, Canada. While I barely saw the city, I got to hang out with some awesome Mac Sys Admins and Dev Ops people. I’ve not been to a...
View ArticleClik here to view.
New Presentation from SANS DFIR Summit 2019 - They See Us Rollin', They...
Heather Mahalik and I teamed up again this year at the SANS DFIR Summit to present on iOS CarPlay and Android Auto.Presentation is here. Will post a link to the video when it’s available.Always a good...
View ArticleClik here to view.
iOS Location Mapping with APOLLO - I Know Where You Were Today, Yesterday,...
I added preliminary KMZ (zipped KML) support to APOLLO. If any APOLLO module’s SQL query has “Location” in its Activity field, it will extract the location coordinates in the column “Coordinates” as...
View ArticleClik here to view.
iOS Location Mapping with APOLLO – Part 2: Cellular and Wi-Fi Data (locationd)
My previous article showed a new capability of APOLLO with KMZ location file support. It worked great…for routined data, but there was something missing. What about the cellular and Wi-Fi locations...
View ArticleClik here to view.
Just Call Me Buffy the Proto Slayer – An Initial Look into Protobuf Data in...
I was first introduced to the protobuf data format years ago accidentally when I was doing some MITM network analysis from an Android device. The data I was looking at was being transferred in this odd...
View ArticleClik here to view.
On the Third Day of APOLLO, My True Love Gave to Me – Application Usage to...
On this third day, we will focus on application usage. We will cover three databases:KnowledgeC.dbBe sure to check out more detailed information on this database in my two previous articles.Access to...
View ArticleClik here to view.
On the Fourth Day of APOLLO, My True Love Gave to Me – Media Analysis to...
The fourth day brings us media artifacts using the knowledgeC.db and CurrentPowerlog.PLSQL databases. Each database stores similar yet somewhat different records when it comes to audio, and video...
View ArticleClik here to view.
On the Fifth Day of APOLLO, My True Love Gave to Me – A Stocking Full of...
Today we go over one of the stranger databases on iOS, the Aggregate Dictionary database, or ADDataStore.sqlitedb. This database is only available with a physical file system dump in the...
View ArticleClik here to view.
On the Sixth Day of APOLLO, My True Love Gave to Me – Blinky Things with...
On this sixth day we’re going to go back to looking at the knowledgeC.db and CurrentPowerlog.PLSQL databases. If you are unfamiliar with these databases, please go back a few blogs. Today is all about...
View ArticleClik here to view.
On the Seventh Day of APOLLO, My True Love Gave to Me – A Good Conversation –...
Today is all about the CurrentPowerlog.PLSQL database. This database keeps track of many ways that data is transferred either by cellular, Wi-Fi, or Bluetooth methods. These modules can help determine...
View ArticleClik here to view.
On the Eighth Day of APOLLO, My True Love Gave to Me – A Glorious Lightshow –...
Today we’ll be analyzing the knowledgeC.db and CurrentPowerlog.PLSQL database for various connections. The first thing you may want to know in an investigation is – was the device plugged in or not?...
View ArticleClik here to view.
On the Ninth Day of APOLLO, My True Love Gave to Me – A Beautiful Portrait –...
The interface of the device can produce some useful artifacts. Starting with screen orientation. Perhaps you want to know if the user was watching a video for a period of time. In conjunction with...
View ArticleClik here to view.
On the Tenth Day of APOLLO, My True Love Gave to Me – An Oddly Detailed Map...
I saved one of my favorite topics for (nearly) last. There is no question that location can play a major role in many investigations. iOS location data as changed drastically with iOS 11 from previous...
View ArticleClik here to view.
On the Eleventh Day of APOLLO, My True Love Gave to Me – An Intriguing Story...
I did a blog article, especially about the knowledgeC.db about a day in the life of my iPhone and it went over really well. I’ve decided to do a similar story using all the data that I’ve parsed from...
View ArticleOn the Twelfth Day of APOLLO, My True Love Gave to Me – A To Do List – Twelve...
My Christmas gift to you - improvements!More Queries – There is plenty more to come. There are more databases and many half-written queries that I have yet to add.Additional Testing – I want these to...
View ArticleVideo of 'From Apple Seeds to Apple Pie' from Objective by the Sea - Now...
Videos have been posted from Objective by the Sea from this past November. My talk ‘From Apple Seeds to Apple Pie’ a pattern of life talk about my APOLLO tools is here.As always, my videos and...
View ArticleClik here to view.
Network and Application Usage using netusage.sqlite & DataUsage.sqlite iOS...
Two iOS databases that I’ve always found interesting (and probably should test more) are netusage.sqlite and DataUsage.sqlite. These two databases contain very similar information – one is available in...
View ArticleClik here to view.
Apple Pattern of Life Lazy Output’er (APOLLO) Updates & 40 New Modules...
I started filling in the gaps to missing APOLLO modules. While doing this I realized there was some capability that was missing with the current script that had to be updated. As far as script updates...
View Article