Blog
Apple Maps - Visited Location?
Ian Whiffin - 27th February 2024
Was an Apple Maps route location actually visited - and the journey it takes to get the answer.

Click here to read full article

BrowserState.db last_viewed_time?
Ian Whiffin - 24th November 2023
A blog to answer a fairly common question about Safari's BrowserState.db and the meaning of last_viewed_time.

Click here to read full article

KnowledgeC Complete(ish)
Ian Whiffin - 21th August 2023
A close look at knowledgeC and attempt to answer some of those lingering questions. Despite knowledgeC's seeming retirement it is still good to know.

Click here to read full article

Location Accuracy
Ian Whiffin - 20th June 2023
A close look at Locations Accuracy. Yes. Again.

Click here to read full article

iOS16 iMessages
Ian Whiffin - 8th June 2022
A look at iOS16's new Edit/Unsend iMessage Feature

Click here to read full article

ArtExtraction
Ian Whiffin - 24th November 2021
Using ArtEx for Live Connection Research

Click here to read full article

The case of the Phantom Device Usage
Ian Whiffin - 12th November 2021
Unmasking the phantom device user...

Click here to read full article

Message Reactions
Ian Whiffin - 2nd November 2021
An interesting little tidbit about Message Reactions and how it may come in handy.??

Click here to read full article

iOS Media Adjustments
Ian Whiffin - 26th October 2021
iOS now allows users to "Adjust" the time and location of recorded media. What affect will that have on forensic examinations?

Click here to read full article

iOS GeoFences
Ian Whiffin - 23rd October 2021
A look at Consolidated.db (GeoFences) on iOS.

Click here to read full article

Health Data Types
Ian Whiffin - 1st September 2021
A look at the various Data Types in use within the iOS Health Application.

Click here to read full article

Harvested Locations
Ian Whiffin - 26th March 2021
EncryptedB.db appears to be a gold mine of location data. But is it really?

Click here to read full article

Missing SQLite Records Analysis
Shafik G. Punja & Ian Whiffin - 1st February 2021

Click here to read full article

Upgrade from NULL
Heather Mahalik & Ian Whiffin - 3rd December 2020
A look at the different clues for determining when a device was wiped

Click here to read full article

Locations, Locations, Locations
Ian Whiffin - 18th July 2020
A detailed look at Location data. How it is obtained and how accurate it is.

Click here to read full article

Favicons
Ian Whiffin - 7th June 2020
A look at how Favicons may be useful to your investigation.

Click here to read full article

CheckRa1n
Ian Whiffin & Shafik G. Punja - 16th April 2020
A look at extracting iOS devices into a TAR archive using ios_bfu_triage.

Click here to read full article

Primary Key / Date Stamp Fallacy
Ian Whiffin - 4th April 2020
A brief look at missing records within communication databases.

Click here to read full article

iOS Mail
Ian Whiffin - 29th March 2020
A dive into the standard email client on iOS devices.

Click here to read full article

So Long Lockdown!
Ian Whiffin - 8th February 2020
The end of Lockdown.log; A quick post to say goodbye.

Click here to read full article

Apple Pay Transactions
Ian Whiffin - 8th February 2020
Extracting Apple Pay Transactions from an iPhone (and Watch)

Click here to read full article

A Hundred Million TimeStamps
Ian Whiffin - 27th Jan 2020
A look at a large number of different TimeStamp formats in use.
Gives examples of what each timestamp looks like, describes how to convert it to a human readable format and provides a calculator to work them out.

Click here to read full article

7bit PDU (GSM-7)
Ian Whiffin - 25th November 2019
A look at 7bit PDU - an important but often overlooked encoding method for SMS Messages. This came about a couple of years ago when a phone I had to examine had messages live on screen that my forensics tool couldn't find. After researching 7bit PDU I was able to manually recover over 500 SMS important to the case.

Click here to read full article

SnapChat PList
Ian Whiffin - 23rd October 2019
A deconstruction of SnapChat's chatConversationStore.plist file (Hint:It's not a PList).

Click here to read full article

PList Decoding
Ian Whiffin - 23rd October 2019
A look at how Binary PLists store data and how to manually decode them.

Click here to read full article

KnowledgeC (and Friends)
Ian Whiffin - 23rd October 2019
KnowledgeC is a common database in recent iOS Versions that holds a wealth of information. This is far from the first time it's been written about, but it ties in perfectly with some software I've been working on and seemed like a nice article for my first blog.

Click here to read full article

Welcome to DoubleBlak.com!
Ian Whiffin - 23rd October 2019
A little bit about me and my new website. Why I did it and what you can expect to find here.

Click here to read full article

Search
Social