Law Enforcement

By Stephanie Thompson, Solutions Engineer Portable case is a feature within Blacklight that allows for shareability of case data for offline review. Data needing to be...

Reviewing location data stored on devices has become a crucial part of many investigations.  GPS coordinates, stored across digital devices, can provide valuable insights about...

By: Vico Marziale (@vicomarziale), Senior Digital Forensics Researcher Introduction In the previous posts, Part 1 and Part 2, we have seen that the Windows Activity Timeline (just "Timeline"...

by Stephanie Thompson, Solutions Engineer Keychains are encrypted containers used on macOS and iOS devices to store usernames and passwords, as well as confidential information such...

When an iPhone is seized, measures should be taken to ensure that the maximum amount of data can be extracted from the device.  iPhone have...

By: Bruce Hunter, Senior Forensic Engineer Starting with macOS 10.12 Apple changed to a new Unified Log format.  Rather than relying on one file to track...

With the release of BlackLight 2020 R1, BlackBag expanded the macOS artifacts processed.  By user request, features were added to process: AirDrop artifacts, built-in iCloud...

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac...

By: Vico Marziale (@vicomarziale), Senior Digital Forensics Researcher Introduction Hello, and welcome back for the second installment of Exploring the Windows Activity Timeline (just “Timeline” from here on...

By: Sarah Edwards, Senior Digital Forensics Researcher While I was researching the Apple Notes application on macOS and iOS, I came across a peculiar scenarios where...