Blog Posts
Harvested Locations
Ian Whiffin
26th March 2021

EncryptedB.db appears to be a gold mine of location data. But is it really?

Click here to read full article
Missing SQLite Records Analysis
Shafik G. Punja & Ian Whiffin
1st February 2021

Click here to read full article
Upgrade from NULL
Heather Mahalik & Ian Whiffin
3rd December 2020

Click here to read full article
Locations, Locations, Locations
Ian Whiffin
18th July 2020

A detailed look at Location data. How it is obtained and how accurate it is.

Click here to read full article
Favicons
Ian Whiffin
7th June 2020

A look at how Favicons may be useful to your investigation.

Click here to read full article
CheckRa1n
Ian Whiffin & Shafik G. Punja
16th April 2020

A look at extracting iOS devices into a TAR archive using ios_bfu_triage.

Click here to read full article
Primary Key / Date Stamp Fallacy
Ian Whiffin
4th April 2020

A brief look at missing records within communication databases.

Click here to read full article
iOS Mail
Ian Whiffin
29th March 2020

A dive into the standard email client on iOS devices.

Click here to read full article
So Long Lockdown!
Ian Whiffin
8th February 2020

The end of Lockdown.log; A quick post to say goodbye.

Click here to read full article
Apple Pay Transactions
Ian Whiffin
8th February 2020

Extracting Apple Pay Transactions from an iPhone (and Watch)

Click here to read full article
A Hundred Million TimeStamps
Ian Whiffin
27th Jan 2020

A look at a large number of different TimeStamp formats in use.
Gives examples of what each timestamp looks like, describes how to convert it to a human readable format and provides a calculator to work them out.

Click here to read full article
7bit PDU (GSM-7)
Ian Whiffin
25th November 2019

A look at 7bit PDU - an important but often overlooked encoding method for SMS Messages. This came about a couple of years ago when a phone I had to examine had messages live on screen that my forensics tool couldn't find. After researching 7bit PDU I was able to manually recover over 500 SMS important to the case.

Click here to read full article
SnapChat PList
Ian Whiffin
23rd October 2019

A deconstruction of SnapChat's chatConversationStore.plist file (Hint:It's not a PList).

Click here to read full article
PList Decoding
Ian Whiffin
23rd October 2019

A look at how Binary PLists store data and how to manually decode them.

Click here to read full article
KnowledgeC (and Friends)
Ian Whiffin
23rd October 2019

KnowledgeC is a common database in recent iOS Versions that holds a wealth of information. This is far from the first time it's been written about, but it ties in perfectly with some software I've been working on and seemed like a nice article for my first blog.

Click here to read full article
Welcome to DoubleBlak.com!
Ian Whiffin
23rd October 2019

A little bit about me and my new website. Why I did it and what you can expect to find here.

Click here to read full article