On this third day, we will focus on application usage. We will cover three databases:KnowledgeC.dbBe sure to check out more detailed information on this database in my two previous articles.Access to this database is limited to a file system dump, i…
Lees meerThe iOS Health database may be the easiest database to acquire. While other databases need physical file system dumps of the devices, this database can be accessed with an encrypted iOS backup, or possibly an iCloud acquisition. If you happen to hav…
Lees meerI originally released APOLLO at the Objective by the Sea conference in early November. Since then I’ve received a surprising amount of positive feedback about various analysts using this tool or the accompanying SQL queries on their file system dump…
Lees meerI saw this article “NYC plans to make AirDropping dick pics a crime” on Friday and it got me thinking. What exactly are the cops going to find if they do an analysis of a device…
Lees meerTesting and forensics go hand in hand. You cannot be sure about a certain artifact on what it contains or what certain pieces mean without testing (and not just once, but over a…
Lees meer