Old Dog, New Tricks – Lost Apples 2.0

If you are not familiar with Lost Apples, please read the original post before proceeding. There have been some interesting cases in the news lately that have caused me to give some thought about devices being in proximity to each other, and how to prove that proximity, especially when those who are intent on doing harm are going dark prior to doing their bad deeds…

thebinaryhick.blog

Endtroducing…Lost Apples

I promise I'm OK 🙂 Earlier this year I wrote a post about Observations.db, which is a component of Apple's FindMy functionality. It was the second part of a post I had written in 2024 about rogue Bluetooth trackers and FindMy compatible devices on iOS devices. In short, FindMy data can offer examiners additional sources of location information along with information about other Apple devices that may be on a given account.

thebinaryhick.blog

Further Observations – More on iOS Search Party

iOS is observing. And judging. Note: This article assumes you have read a previous article about AirTags, found here, as it references items associated with iOS searchpartyd with little to no explanation. It is highly recommend you read the previous article before proceeding. Over the past several months I have been exploring iOS’s Search Party. It is that thing…

thebinaryhick.blog

(Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing

Or not. Another summer has flown by. Vacations, court (yes!), classes (also, yes!), and of course the conference circuit were (and still are) all in full effect this year. Things are winding down a little and I finally have a chance to put fingers to keyboard and write about some things I have had in the works. It is getting increasingly difficult these days to find time to sit and write.

thebinaryhick.blog

Week 14 – 2025

Use the discount code thisweekin4n6 for 15% off any class at Cyber5w.Use the code PM15 or click this link for 15% your next Hexordia classTakes a class with me! Akash Patel Understanding Partitioni…

thisweekin4n6.com

Finding Phones With Google Maps Part 1 (Android)

Lost. But not. Note: there is an important update to this article. Please see the appended portion. I am a firm believer that digital forensic artifact discovery is, at times, equal parts persisten…

thebinaryhick.blog

Ridin’ With Apple CarPlay 2

All I ever wanted... It is not often that I get to revisit previous research. Most, if not all, of us do research, share it (hopefully), and then move on to the next thing. There is so much to examine that it is nearly impossible to revisit things, especially in the mobile device space. When we do go back, though, it is usually because something has changed, and that is what happened here.

thebinaryhick.blog

Triple Trouble. iOS 16, Android 14, and iOS 17 Images Now Available!

Right as rain While it wasn’t as “soon” as I would have liked, I am (finally) pleased to announce the availability of public images of iOS 16, Android 14, and iOS 17. A few notes.…

thebinaryhick.blog

Where The Wild Tags Are & Other AirTag Stories.

Accurate depiction of my test phones. Note: this post is a quasi-continuation of my previous post about Bluetooth trackers on the Google Find My Device network. While I typically write about Team G…

thebinaryhick.blog

The Green Look Back. Android’s On-Device Location History

We’re at now, now. Back in December of 2023 Google announced a change to Android’s Location History feature that got quite a bit of attention. Prior to the announcement, users could vie…

thebinaryhick.blog

Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network

Where am I??? NOTE: portions of this post appeared in my presentation at the 2024 SANS DFIR Summit. Where did the summer go? August is almost behind us, but it seems like yesterday the kids got out…

thebinaryhick.blog

Android & AirTags (Part II)

IYKYK. Summer (and DFIR conference season) is in full swing, so things have been busy! However, an opportunity presented itself recently that I could not allow to pass: revisiting a subject I previ…

thebinaryhick.blog