Our need will be the real creator. - Plato, The Republic I have been quiet the past few months, but that does not mean I haven't been busy. While working on a larger project I found myself getting really annoyed with timestamps. Because I was working on my Mac, I was having to run out to a website I have used for years for quick timestamp decoding, but I was annoyed with the fact that I was having to do that.

If you are not familiar with Lost Apples, please read the original post before proceeding. There have been some interesting cases in the news lately that have caused me to give some thought about devices being in proximity to each other, and how to prove that proximity, especially when those who are intent on doing harm are going dark prior to doing their bad deeds…

I promise I'm OK 🙂 Earlier this year I wrote a post about Observations.db, which is a component of Apple's FindMy functionality. It was the second part of a post I had written in 2024 about rogue Bluetooth trackers and FindMy compatible devices on iOS devices. In short, FindMy data can offer examiners additional sources of location information along with information about other Apple devices that may be on a given account.

iOS is observing. And judging. Note: This article assumes you have read a previous article about AirTags, found here, as it references items associated with iOS searchpartyd with little to no explanation. It is highly recommend you read the previous article before proceeding. Over the past several months I have been exploring iOS’s Search Party. It is that thing…

Or not. Another summer has flown by. Vacations, court (yes!), classes (also, yes!), and of course the conference circuit were (and still are) all in full effect this year. Things are winding down a little and I finally have a chance to put fingers to keyboard and write about some things I have had in the works. It is getting increasingly difficult these days to find time to sit and write.

Use the discount code thisweekin4n6 for 15% off any class at Cyber5w.Use the code PM15 or click this link for 15% your next Hexordia classTakes a class with me! Akash Patel Understanding Partitioni…

Lost. But not. Note: there is an important update to this article. Please see the appended portion. I am a firm believer that digital forensic artifact discovery is, at times, equal parts persisten…

All I ever wanted... It is not often that I get to revisit previous research. Most, if not all, of us do research, share it (hopefully), and then move on to the next thing. There is so much to examine that it is nearly impossible to revisit things, especially in the mobile device space. When we do go back, though, it is usually because something has changed, and that is what happened here.

Right as rain While it wasn’t as “soon” as I would have liked, I am (finally) pleased to announce the availability of public images of iOS 16, Android 14, and iOS 17. A few notes.…

Accurate depiction of my test phones. Note: this post is a quasi-continuation of my previous post about Bluetooth trackers on the Google Find My Device network. While I typically write about Team G…

We’re at now, now. Back in December of 2023 Google announced a change to Android’s Location History feature that got quite a bit of attention. Prior to the announcement, users could vie…

Where am I??? NOTE: portions of this post appeared in my presentation at the 2024 SANS DFIR Summit. Where did the summer go? August is almost behind us, but it seems like yesterday the kids got out…

IYKYK. Summer (and DFIR conference season) is in full swing, so things have been busy! However, an opportunity presented itself recently that I could not allow to pass: revisiting a subject I previ…