🚀 HEART by Metadata Forensics, Version 2.1.0.2 is here! We’re expanding Apple Health support with 4 new artifacts: 🆕 Medical ID Data 🧼 Handwashing 🪥 Toothbrushing ❤️ Electrocardiograms (ECG)

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

github.com

HEART by Metadata Forensics, Version 2.1.0.0 is live! Our Apple Health Events & Activity Reporting Tools now has Date & Time Filtering, 7 new artifacts, Artifact Selection updates, and improved HTML Reporting. Get it on GitHub: github.com/MetadataFore...

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

github.com

🆕 Major Version Update: HEART by Metadata Forensics v 2.0! 🎉 ✅ Artifact Selection 🕚 Timestamp Display With Artifact Selection you can choose to analyze a single artifact, a subset, or all artifacts. Display timestamps in UTC or convert them to the device's local time. tinyurl.com/38m4xuzs

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

tinyurl.com

🚀 New Release: HEART by Metadata Forensics v1.4.2.0! 🚀 This release adds three new Apple Health application artifacts: 🥗 Nutrition 🔊 Environmental Sound - Detailed 🎧 Headphone Audio Levels - Detailed Free to download on GitHub: github.com/MetadataFore...

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

github.com

🚀 New Release: HEART by Metadata Forensics v1.4.1.0! 🚀 This release adds six new Apple Health application artifacts: 📋 Health Details ❤️ Cardio Recovery 💓 Heart Rate Variability 🧘 Mindful Minutes 🌤️ State of Mind 🌬️ Breathing Disturbances Free to download on GitHub: github.com/MetadataFore...

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

github.com

Check out our newest article, Empirical Assessment of Apple Health Activity Data: Accuracy, Granularity, and Database Artifacts! Looking deeper into the cache_encryptedC.db and iOS 26 changes. Article: tinyurl.com/ae8akwm5 Support updated to HEART: tinyurl.com/v8zesb7h

KMLer turns CSV and XLSX files into KML files while adding the investigative context examiners and analysts need. 🕵️ Horizontal accuracy visualized, extended data, processing report, and more! Read more here: tinyurl.com/y8d3je3m  Get it here: tinyurl.com/3fw8vnn8

🚀 New Release: HEART by Metadata Forensics Version 1.3! 🚀 We’ve added Local Device Time conversions! most Apple Health and Fitness application artifacts are linked to the device recorded the event, the associated time zone is preserved as well. Conversions by activity! github.com/MetadataFore...

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

github.com

Couldn’t start the week better-thank you Christopher Vance for the shout-out in your session, Harping on health data, during the Magnet Virtual Summit 2026! Your Mobile Unpacked series has helped so many of us, and it’s genuinely humbling to have my Apple Health contributions mentioned alongside it.

Ever wondered what secrets are in your Apple Contacts? 📱 iQueryContacts 🕵️ is our new advanced SQL query work for the AddressBook.sqlitedb. All the classic data plus some new info including the Chinese lunar birthday! Find out more at github.com/MetadataFore...

GitHub - MetadataForensics/iQueryContacts: Advanced parser for Apple Contacts (AddressBook.sqlitedb) with phones, emails, addresses, social accounts, birthdays (including Chinese lunar), and group mem...

Advanced parser for Apple Contacts (AddressBook.sqlitedb) with phones, emails, addresses, social accounts, birthdays (including Chinese lunar), and group memberships. - MetadataForensics/iQueryCont...

github.com

🧩 RowIDetective 🕵️‍♂️ formerly detailed Lagging for the Win: Querying for Negative Evidence in the sms.db. Now detecting missing messages at the end of Apple sms.db. Because every gap tells a story. 🔗 github.com/MetadataFore...

GitHub - MetadataForensics/RowIDetective: An update to our prior work within Lagging for the Win, now reporting all sms.db missing ROWID values up to the message sequence number.

An update to our prior work within Lagging for the Win, now reporting all sms.db missing ROWID values up to the message sequence number. - MetadataForensics/RowIDetective

github.com

🚀 New release! HEART by Metadata Forensics (Health Events & Activity Reporting Tool) Version 1.1.0.0! Now supporting TAR, DAR (some), Advanced Logical (Encrypted) Extractions, iTunes Encrypted Backups. ⬇️ Download: tinyurl.com/v8zesb7h 📖 Article: tinyurl.com/94rx6vk4

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

tinyurl.com

HEART by Metadata Forensics (Health Events & Activity Reporting Tool) Free tool to parse Apple Health & Fitness data from FFS Extractions. 🔍 31+ artifacts supported 📊 HTML report + CSV/PDF export ⬇️ Download: tinyurl.com/v8zesb7h 📖 Article: tinyurl.com/94rx6vk4

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

tinyurl.com

Thanks to our great DFIR Community and discussion on the matter, I’m happy to announce our Google Location History Takeout Parser, Version 1.4.1. We’ve added Horizontal Accuracy KMLs for Records.JSON data and Parking Events. Get it at tinyurl.com/4aua56u4 Google Earth example:

🚀 Google Location History Timeline Parser v 1.4 is now available! This release features multithreaded processing, time elapsed tracking, input file size calculation, and location-related files including HTML, CSV, and TXT. Available here: tinyurl.com/4dr3tuv5

GitHub - MetadataForensics/Google-Location-History-Takeout-Parser: This free tool parses Google Takeout Location History Exports or Google Semantic Location History Warrant Return Data in a forensic m...

This free tool parses Google Takeout Location History Exports or Google Semantic Location History Warrant Return Data in a forensic manner. - MetadataForensics/Google-Location-History-Takeout-Parser

tinyurl.com

🚀 Google Location History Takeout Parser Version 1.3.0.0 is here! 🎉 With enhanced KML support (TimeSpans, Descriptions & LineStrings), taking your data to the next level. Continue leveraging Google Location History Takeout & Warrant Return data. 👉 tinyurl.com/2s8yzksx

GitHub - MetadataForensics/Google-Location-History-Takeout-Parser: This free tool parses Google Takeout Location History Exports or Google Semantic Location History Warrant Return Data in a forensic m...

This free tool parses Google Takeout Location History Exports or Google Semantic Location History Warrant Return Data in a forensic manner. - MetadataForensics/Google-Location-History-Takeout-Parser

tinyurl.com

Excited for this release, best is yet to come with the LEAPPs! Fantastic project, resource, and tool

Kevin 🤖🕵️🍺@stark4n6.bsky.social · 2y ago

New #iLEAPP 2.1.0 release is out! #DFIR github.com/abrignoni/iL...

We’re thrilled to unveil "Legal Bytes in a Digital World," our new article series examining the intersection of law, technology, and digital forensics. In our debut piece, we explore US v. Strong - available here: tinyurl.com/ymn2ju28 Stay tuned for in-depth analysis and expert perspectives in DFIR.

Examining the United States v. Ladonies P. STRONG Case

The case US v. Strong addresses the legality of warrantless searches of mobile devices, highlighting Fourth Amendment privacy rights. When Strong’s device was searched without a warrant, it r…

tinyurl.com

Many thanks to Magnet Forensics, Hexordia, and the CTF authors for this great experience! Glad the timing worked out that I was able to participate - really enjoyable, creative, and challenging. Still may go back and look at some more of these questions..

Jessica Hyde@b1n2h3x.bsky.social · 2y ago

Congratulations to the winners of the Magnet Forensic Virtual Summit 2025 CTF powered by Hexordia 1st place: @deagler 2nd Place: @Cognitor4n6 3rd Place: @Potato 1st Place Team: @X Still time to play for the First to Finish! #MVS2025CTF #DFIR

🔍 New article from Metadata Forensics! 📱 “Hello! Who is on the Line?” – we’re diving into parsing iPhone group calls, something not previously supported by commercial or open-source mobile forensic tools. Check it out 👉 tinyurl.com/3n6c3374

Hello! Who is on the Line?

Have you ever wondered how many individuals were on a phone call or Facetime call when reviewing data extracted from an iOS device? This question came up in a case recently when information was dev…

tinyurl.com

🕵️‍♂️💾 Uncover your device’s secret history! "Beyond the Logs: Using the Health App to Uncover Device Model and OS History" explores Health Application databases to reveal Apple model & OS info. Find out more at tinyurl.com/2dfwn5xs #metadataforensics #DFIR

Beyond the Logs: Using the Health App to Uncover Device Model and OS History

This article explores both the healthdb_secure.sqlite and healthdb.sqlite databases for data indicating devices possessed by the user, reviews device information hand-in-hand with OS version and ti…

tinyurl.com

This Thanksgiving, I’m grateful for the opportunity to make a difference and help bring justice to light. It’s the small details that matter, and I’m thankful to be part of a journey that strives for truth and fairness for all. Wishing everyone a meaningful Thanksgiving!

Let’s discuss: unpopular opinion? iOS 18: AFU is <72 hrs from reboot and BFU state. Lot of extraction ASAP talk, regardless of search auth. You can articulate, but with auth prior you don’t have to. What am I missing? Are auths after device seizure really going beyond 24 hrs?

Our latest course review is now available! 📱🧠 Explore Hexordia’s Mobile Data Structures: Honing Your Digital Forensic Edge for our thoughts on this course. 📈📊 Find it here: tinyurl.com/msb27jyz 🔗

Hexordia’s Mobile Data Structures: Honing Your Digital Forensic Edge

Hexordia's Mobile Data Structures course offers comprehensive training in SQLite, PList, LevelDB, and Protobuf analysis. With interactive Zoom sessions and hands-on tasks, it provides valuable insight...

tinyurl.com

🚀 New Release Alert! 🎉 Check out the latest versions of our Google Location History Timeline Parser and Brute Force Dictionary List Generator! Now with a new graphical interface and enhanced functionality. Download today at github.com/MetadataFore...! 🚀

MetadataForensics - Overview

Alongside seeking the digital truth and client satisfaction in all our cases, we also strive to further the DFIR Community with our research and work products. - MetadataForensics

github.com

New Blog Alert: Rookie Reflections: A Green Examiner's Forensic Journey Into Cellebrite, available here: tinyurl.com/3xbmcrje. Discover insights, challenges, and tips from one of our newest team members in her review of Cellebrite’s CCO course!

Rookie Reflections: A Green Examiner’s Forensic Journey Into Cellebrite

I came to Metadata Forensics from a local Police department in Georgia, and while I thoroughly enjoyed the “figure it out” education I accrued there. I was excited to start adding the letters to the e...

tinyurl.com

Wake up to our new article, Sleepless in Cupertino: A Forensic Dive into Apple Watch Sleep Tracking! 🌙 Review how Sleep data is stored and explore parsing with SQL query solutions. 🔍 Learn how this could lend insight into the future Vitals app! 📈 tinyurl.com/yc43kpme

Sleepless in Cupertino: A Forensic Dive into Apple Watch Sleep Tracking

How's your sleep been lately? Currently, there are numerous sleep tracking and monitoring devices available to track, monitor, and quantify sleep patterns for users actively seeking to improve their s...

tinyurl.com