While putting together my previous post on battery information for Bluetooth devices, I was curious about more information regarding these devices. Turbo didn't track much other than the MAC address so I decided to take a peek at the SANS FOR585 for path information. While stumbling through the "misc" folder... [Read More]

UPDATE: Read Part 1 and Part 3!After updating to Android 11 months back I figured I'd dive in and see what changed. I decided to revisit the Turbo battery research I did at the end of 2020. Nothing has changed from what I could see for the turbo.db itself but in... [Read More]

I'm still trying to add more and more content as I see fit and as I test new tools and other useful utilities. Hit me on Twitter @KevinPagano3 if you have suggested adds!Forensic Blog Feeds4n6 KweenForensic ToolscLEAPP - ChromeOS Logs, Events and Protobuf ParserMagnet Chromebook Acquisition AssistantRDB Bitmap Cache ParserRdpCacheStitcherGetting... [Read More]

 Previous: Chromebook | Hunt! | iPhone | MacLast but certainly not least, we have the Google Takeout evidence from the MVS2021 CTF.Question 1 - You got mail (5 points)How many emails were received from notification@service.tiktok.com?Switching over to Cloud Gmail Messages and filtering on the From Address to "TikTok", we see 6... [Read More]

Previous: Chromebook | Hunt! | iPhoneI will say that the Mac image was by far the most difficult for me. I have very little experience other than SANS DFIR NetWars in looking at Macs forensically. I'm thankful to have AXIOM by my side for this one to help ease my... [Read More]