Yogesh Khatri's forensic blog

A long time ago I wrote some code to make NSKeyedArchives (NSKA) human readable, basically de-serializing the data. It was then converted to...

In the last OneDrive blog post , I outlined how the ODL file format is structured. A working version of an ODL parser was also created to re...

Due to the popularity of OneDrive, it has become an important source of evidence in forensics. Last week, Brian Maloney posted about his res...

Gboard - the Google Keyboard, is the default keyboard on Pixel devices, and overall has been installed over a billion times according to the...

Background Tracking down an iOS application's Data folder, aka, SandboxPath in iOS is fairly easy. One simply needs to look at the appli...

ios_apt is the new shiny companion to  mac_apt ios_apt is not a separate project, it's just a part of the mac_apt framework, and serves ...

App snapshots on iOS are stored as KTX files, this is fairly well known at this point, thanks to the research by Geraldine Blay ( @i_am_t...