SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

iOS Location Mapping with APOLLO Part 2: Cellular and Wi-Fi Data (locationd)

Myprevious articleshowed a new capability ofAPOLLOwith KMZ location file support. It worked great''for routined data, but there was something missing. What about the cellular and Wi-Fi locations that are stored in databases? Well, turns out I need to test better. I fixed the locationd modules to have the activity as "Location" versus "LOCATION". Case sensitivity is apparently thing in Python''my bad. '''''

I should also mention with the fixes, my total location data points for a iOS 12.1.1 device jumped to ~57,000! I should note this is not inclusive of workout locations. Those are a bit different as they are stored as separate records, one for latitude and one for longitude. In the future I might attempt to pair these up for KMZ support.


iOS Location Mapping with APOLLO Part 1: I Know Where You Were Today, Yesterday, Last Month, and Years Ago!

I added preliminary KMZ (zipped KML) support toAPOLLO. If anyAPOLLOmodule's SQL query has "Location" in its Activity field, it will extract the location coordinates in the column "Coordinates" as long as they are in Latitude, Longitude format (ie: 38, -77). These are more a less an upgrade/replacement from my previous iOS location scripts. (FYI: Those will not likely be updated further.)


Triage Collection and Timeline Generation with KAPE

As a follow up to my SANSwebcast, which you can view here, I wanted to post detailed instructions on how to use KAPE to collect triage data and generate a mini-timeline from the data collected. As much as I hate to say "push button forensics", once you get KAPE up and running, it really is … Continue reading Triage Collection and Timeline Generation with KAPE


A few Ghidra tips for IDA users, part 4 - function call graphs

One of the features of IDA that we use in FOR610 that can be helpful for detecting malicious patterns of API calls is the feature for creating a graph of all function calls called from the current function and any functions that it calls. The graph itself isn't all that pretty to look at, but … Continue reading A few Ghidra tips for IDA users, part 4 - function call graphs


Finding Registry Malware Persistence with RECmd

If you have been keeping your forensic toolkit up to date, you have undoubtedly used Registry Explorer, a game-changing tool for performing Windows registry analysis. RECmd is the command line component of Registry Explorer and opens up a remarkable capability to script and automate registry data collection. My interest in this tool was recently … Continue reading Finding Registry Malware Persistence with RECmd