#iosforensics

2 posts · Last used 2h

Back to Timeline
Alexis Brignoni :python: :donor: @abrignoni@infosec.exchange · 2h ago
Mattia Epifani published "84 Streams Later", tracking Apple Biome from iOS 14 through iOS 26 and what it means for examiners. Community work at its best: he found the streams and shared samples, we wrote and validated the parsers. iLEAPP went from 45 Biome artifacts to 101 in two days. Where we could check a field against another source on the same device, we did. Call direction against CallHistory, message direction against sms.db, lock state against the DKEvent streams. Where we could not confirm a value, the column says raw and the notes say why. Run from python code to benefit today. Parsers will be added to the next tool release soon Free and open source, as always. Blog: https://blog.digital-forensics.it/2026/07/84-streams-later-exploring-evolution-of.html iLEAPP: https://leapps.org/releases#section-ileapp #DFIR #MobileForensics #iOSForensics
0
0
0
Alexis Brignoni :python: :donor: @abrignoni@infosec.exchange · 2d ago
New iLEAPP artifact: Biome - Device TimeZone, contributed by Cynthia van Dorp. Starting around iOS 17, the Device.TimeZone biome stream keeps a record of every timezone the device switches into, each entry with a SEGB timestamp. That means a built-in travel timeline: on one of our test images the output showed the device going New York, then Chicago, then Honolulu, then back, all with exact times. Tested against 8 iOS 17 and 18 images from our corpus before merging. Free and open source, as always. #DFIR #iosforensics #mobileforensics
0
0
0

You've seen all posts