Publications · DFIR Review

DFIR Review - Publications

Reviewed and accepted work addressing emerging challenges in digital forensics, incident response, and cyber-investigation.

Location, Location, Location

by Ian Whiffin

Published: Aug 29, 2024

How Did That Photo Get On That iPhone

by Steve Bunting

Published: Apr 04, 2024

Peeking at User Notification Events in iOS 15

by Geraldine Blay and Alexis Brignoni

Published: Aug 03, 2023

iOS Location Services and System Services are they ON or OFF

by Scott Koenig and Ian Whiffin

Published: Jul 11, 2022

Enriching Investigations with Apple Watch Data Through the healthdb_secure.sqlite Database

by James McGee

Published: Jan 05, 2023

Wipeout! Detecting Android Factory Resets

by Joshua Hickman

Published: Nov 03, 2022

iOS KnowledgeC.db Notifications

by Scott Koenig

Published: Nov 03, 2022

An Alternate Location for Deleted SMS/iMessage Data in Apple Devices

by James McGee

Published: Nov 03, 2022

iOS Settings Display Auto-Lock & Require Passcode

by Scott Koenig

Published: Jun 02, 2022

Turbo Speed: Parsing Device Health Services from Google

by Kevin Pagano

Published: Sep 28, 2022

Ain’t That a Kik in the Head: Kik Messenger iOS Analysis

by Kevin Pagano and Alexis Brignoni

Published: Apr 11, 2022

Validation of X-Ways Forensics Evidence File Containers

by Larry Jones

Published: Dec 29, 2021

USB Forensics – Recover more Volume Serial Numbers (VSNs) with the Windows 10 Partition/Diagnostic Event Log

by Alexandros Vasilaras, Evangelos Dragonas, and Dimitrios Katsoulis

Published: May 26, 2021

Missing SQLite Records Analysis

by Shafik Punja and Ian Whiffin

Published: Jul 29, 2021

Case Study: Forensic Analysis of TikTok on iOS

by Dr. Graeme Horsman and Linda Shou

Published: Apr 11, 2022

Upgrade From NULL—Detecting iOS Wipe Artifacts

by Heather Mahalik and Ian Whiffin

Published: Jun 24, 2021

Extracting and Decrypting iOS Keychain: Physical, Logical and Cloud Options Explored

by Vladimir Katalov

Published: Feb 04, 2021

Using Photos.sqlite to Show the Relationships Between Photos and the Application they were Created with?

by Scott Koenig

Published: Feb 04, 2021

Can You Track Processes Accessing the Camera and Microphone on Windows 10?

by Zachary Stanford

Published: Nov 19, 2020

How to Use iOS Bluetooth Connections to Solve Crimes Faster

by Heather Mahalik and Matt Goeckel

Published: Nov 16, 2020

Can Google Takeout Location Data Be Trusted?

by Ross Donnelly

Published: Nov 02, 2020

How Android Bluetooth Connections Can Determine if a Driver had Their Hands on the Wheel During an Accident

by Heather Mahalik

Published: Nov 05, 2020

Tinkering with TikTok Timestamps

by Ryan Benson

Published: Sep 25, 2020

Windows 10 Jump List and Link File Artifacts - Saved, Copied and Moved

by Larry Jones

Published: Sep 25, 2020

Parsing Google’s Now Playing History on Pixel Devices

by Kevin Pagano

Published: Aug 31, 2020

Chromebook Forensic Acquisition

by Daniel Dickerman

Published: May 26, 2020

OK Computer...er...Google. Dissecting Google Assistant (Part Deux)

by Joshua Hickman

Published: May 26, 2020

OK Computer...er...Google. Dissecting Google Assistant (Part 1)

by Joshua Hickman

Published: May 26, 2020

Google Search Bar & Search Term History - Are You Finding Everything?

by Joshua Hickman

Published: May 26, 2020

Ka-Chow!!! Driving Android Auto

by Joshua Hickman

Published: Mar 31, 2019

What information is recoverable from an Android device that is connected to a vehicle with using the Android Auto app?

What was my IP? Ask DoSvc on Windows 10

by Gabriele Zambelli

Published: Mar 31, 2019

What was the public IP address of a Windows 10 device?

iOS Mobile Installation Logs

by Alexis Brignoni

Published: Mar 31, 2019

What applications were installed on an iOS device and when?

How was an iPhone set up?

by Heather Mahalik

Published: Mar 31, 2019

Was an iPhone restored from iCloud, iTunes backup or started from scratch?