DoubleBlak RSS

Safari Walkthrough

Mon 13 Oct 2025 00:00:00 GMT

A step-by-step guide for testing BrowserState.db artifacts.

iPhone Pocket State

Sun 29 Jun 2025 00:00:00 GMT

iPhones record Pocket State in the Unified Logs which can help show if the camera was obstructed.

iPhone Internal Battery Temperature

Sun 29 Jun 2025 00:00:00 GMT

iPhones monitor the battery temperature for safety and performance - but how accurate is the thermometer?

Apple Health Accuracy Reliability

Sat 28 Jun 2025 00:00:00 GMT

A look into the accuracy of Apple Health with regard to steps, distance and flights climbed.

CurrentPowerLog the Monotonic Clock

Sat 28 Jun 2025 00:00:00 GMT

A look at how Apple store timestamps in CurrentPowerLog (and associated databases) and why the timestamps shouldn;t be taken at face value.

It's about time.

Sun 22 Sep 2024 00:00:00 GMT

Sync Peers

Sun 22 Sep 2024 00:00:00 GMT

A look at how multiple devices can contribute to data in knowledgeC

BrowserState.db last_viewed_time? (Again)

Tue 02 Jul 2024 00:00:00 GMT

A follow up post to my previous last_viewed_time post in BrowserState.db

Apple Maps - Visited Location?

Tue 27 Feb 2024 00:00:00 GMT

Was an Apple Maps route location actually visited - and the journey it takes to get the answer.

BrowserState.db last_viewed_time?

Fri 24 Nov 2023 00:00:00 GMT

A blog to answer a fairly common question about Safari's BrowserState.db and the meaning of last_viewed_time.

KnowledgeC Complete(ish)

Mon 21 Aug 2023 00:00:00 GMT

A close look at knowledgeC and attempt to answer some of those lingering questions. Despite knowledgeC's seeming retirement it is still good to know.

Location Accuracy

Tue 20 Jun 2023 00:00:00 GMT

A close look at Locations Accuracy. Yes. Again.

iOS16 iMessages

Wed 08 Jun 2022 00:00:00 GMT

A look at iOS16's new Edit/Unsend iMessage Feature

ArtExtraction

Wed 24 Nov 2021 00:00:00 GMT

Using ArtEx for Live Connection Research

The case of the Phantom Device Usage

Fri 12 Nov 2021 00:00:00 GMT

Unmasking the phantom device user...

Message Reactions

Tue 02 Nov 2021 00:00:00 GMT

An interesting little tidbit about Message Reactions and how it may come in handy.??

iOS Media Adjustments

Tue 26 Oct 2021 00:00:00 GMT

iOS now allows users to "Adjust" the time and location of recorded media. What affect will that have on forensic examinations?

iOS GeoFences

Sat 23 Oct 2021 00:00:00 GMT

A look at Consolidated.db (GeoFences) on iOS.

Health Data Types

Wed 01 Sep 2021 00:00:00 GMT

A look at the various Data Types in use within the iOS Health Application.

Harvested Locations

Sun 21 Mar 2021 00:00:00 GMT

EncryptedB.db appears to be a gold mine of location data. But is it really?

Missing SQLite Records Analysis

Mon 01 Feb 2021 00:00:00 GMT

Upgrade from NULL

Thu 03 Dec 2020 00:00:00 GMT

A look at the different clues for determining when a device was wiped

Locations, Locations, Locations

Sat 18 Jul 2020 00:00:00 GMT

A detailed look at Location data. How it is obtained and how accurate it is.

Favicons

Sun 07 Jun 2020 00:00:00 GMT

A look at how Favicons may be useful to your investigation.

CheckRa1n

Thu 16 Apr 2020 00:00:00 GMT

A look at extracting iOS devices into a TAR archive using ios_bfu_triage.

Primary Key / Date Stamp Fallacy

Sat 04 Apr 2020 00:00:00 GMT

A brief look at missing records within communication databases.

iOS Mail

Sun 29 Mar 2020 00:00:00 GMT

A dive into the standard email client on iOS devices.

So Long Lockdown!

Sat 08 Feb 2020 00:00:00 GMT

The end of Lockdown.log; A quick post to say goodbye.

Apple Pay Transactions

Sat 08 Feb 2020 00:00:00 GMT

Extracting Apple Pay Transactions from an iPhone (and Watch)

A Hundred Million TimeStamps

Mon 27 Jan 2020 00:00:00 GMT

A look at a large number of different TimeStamp formats in use.
Gives examples of what each timestamp looks like, describes how to convert it to a human readable format and provides a calculator to work them out.

7bit PDU (GSM-7)

Mon 25 Nov 2019 00:00:00 GMT

A look at 7bit PDU - an important but often overlooked encoding method for SMS Messages. This came about a couple of years ago when a phone I had to examine had messages live on screen that my forensics tool couldn't find. After researching 7bit PDU I was able to manually recover over 500 SMS important to the case.

SnapChat PList

Wed 23 Oct 2019 00:00:00 GMT

A deconstruction of SnapChat's chatConversationStore.plist file (Hint:It's not a PList).

PList Decoding

Wed 23 Oct 2019 00:00:00 GMT

A look at how Binary PLists store data and how to manually decode them.

KnowledgeC (and Friends)

Wed 23 Oct 2019 00:00:00 GMT

KnowledgeC is a common database in recent iOS Versions that holds a wealth of information. This is far from the first time it's been written about, but it ties in perfectly with some software I've been working on and seemed like a nice article for my first blog.

Welcome to DoubleBlak.com!

Wed 23 Oct 2019 00:00:00 GMT

A little bit about me and my new website. Why I did it and what you can expect to find here.