Christopher Vance
@cscottvance.bsky.social
Mobile Forensics Researcher. iOS nerd. fanboy. Opinions are my own, not my employer.
ICYMI: During yesterday's Mobile Unpacked I announced a new challenge! The Mobile Unpacked Artifact Hunt will begin next month. Be sure to keep a watch on the main Mobile Unpacked landing page as well for hint drops!
www.magnetforensics.com/blog/the-mob...
www.magnetforensics.com/blog/the-mob...
The Mobile Unpacked Artifact Hunt challenge begins! - Magnet Forensics
Ready to turn artifacts into a fun reward? Let’s dig into the digital and uncover hidden insights with our Mobile Unpacked: Artifact Hunt Challenge—a fun, knowledge-based way to explore key mobile f...
www.magnetforensics.com
July 31, 2025 at 2:05 PM
ICYMI: During yesterday's Mobile Unpacked I announced a new challenge! The Mobile Unpacked Artifact Hunt will begin next month. Be sure to keep a watch on the main Mobile Unpacked landing page as well for hint drops!
www.magnetforensics.com/blog/the-mob...
www.magnetforensics.com/blog/the-mob...
Reposted by Christopher Vance
Do NOT miss today's episode if you're doing iOS collections! The actions you take and when you take them can ABSOLUTELY impact the amount of data recovered! PRESERVE your data by using the right tools, the right way.
On April 23, join us for a new episode of #MobileUnpacked where @cscottvance.bsky.social will break down the “best before” dates of our favorite artifacts and deeper explore how to maximize the amount of data retained and extracted: ow.ly/ro5N50VCtxC #DFIR #MobileForensics
S3:E4 // Discussing the Data Drop-Off - Magnet Forensics
iOS has long been known for only storing certain records for a fixed period of time. In some cases, artifacts may only be stored on device for a few days, and in others, never deleted without the user...
ow.ly
April 23, 2025 at 12:52 PM
Do NOT miss today's episode if you're doing iOS collections! The actions you take and when you take them can ABSOLUTELY impact the amount of data recovered! PRESERVE your data by using the right tools, the right way.
Digital Forensic professionals are just raccoons. We are digital dumpster divers searching for goodies.
Trash Panda squad, go!
Trash Panda squad, go!
March 7, 2025 at 2:38 PM
Digital Forensic professionals are just raccoons. We are digital dumpster divers searching for goodies.
Trash Panda squad, go!
Trash Panda squad, go!
I’m headed back to Australia and New Zealand again! Looking forward to showing some awesome new stuff from our product teams and my latest iOS/Android research!
We're coming to Australia & New Zealand in April for our ANZ Roadshows! Public sector attendees will have the chance to hear more about our latest solutions and #MobileForensics w/ @cscottvance.bsky.social. See if we're coming to a city near you and register: www.magnetforensics.com/anz-roadshows/.
March 6, 2025 at 7:12 PM
I’m headed back to Australia and New Zealand again! Looking forward to showing some awesome new stuff from our product teams and my latest iOS/Android research!
Funny enough this is going to become really important for next month’s episode on mobile AI services like Siri, Galaxy AI, and Gemini. Want to see it early? I’ll be debuting the talk at MUS in Nashville! Come join us!
Did you miss our special #MVS2025 edition of #MobileUnpacked? A recording is now available on demand, so this is your chance to catch up on @cscottvance.bsky.social's overview of data structures in iOS: ow.ly/BvXG50V4fKY #DFIR #MobileForensics #iOSInvestigations #MagnetVirtualSummit
S3:E2 // apples, onions, and ogres: dealing with layered iOS data structures - Magnet Forensics
In the Dreamworks film Shrek, the titular character said that 'Ogres are like onions. They have layers.' Well, Apple isn't so different from the green hero in that their lovable monster, iOS also feat...
ow.ly
February 21, 2025 at 2:32 PM
Funny enough this is going to become really important for next month’s episode on mobile AI services like Siri, Galaxy AI, and Gemini. Want to see it early? I’ll be debuting the talk at MUS in Nashville! Come join us!
Don’t forget! Today at 1 eastern you can watch the latest Mobile Unpacked as an MVS early release!
We're excited to unveil the next episode of #MobileUnpacked at #MagnetVirtualSummit 2025! Join us at #MVS2025 to hear
@cscottvance.bsky.social cover how to identify data structures and how to find the key artifact data hidden across different file types: ow.ly/3eaa50UTmaQ #DFIR
@cscottvance.bsky.social cover how to identify data structures and how to find the key artifact data hidden across different file types: ow.ly/3eaa50UTmaQ #DFIR
February 10, 2025 at 4:03 PM
Don’t forget! Today at 1 eastern you can watch the latest Mobile Unpacked as an MVS early release!
To start the year, and Season 3 (what?!) of Mobile Unpacked, we’re going back to basics on ADB. Come learn what makes the protocol what it is, how it works, and how you can recover information that would otherwise be lost without these valuable commands!
Join us for the next episode of #MobileUnpacked on Jan 29 where @cscottvance.bsky.social will focus on learning the basics up to some advanced ADB commands that can be used to acquire key information and files from Android devices: ow.ly/bNbx50UNV66 #DFIR #MobileForensics
S3:E1 // ADB: It's easy as ABC - Understanding the power of ADB commands - Magnet Forensics
The power of the ADB command protocol is instrumental in the forensic analysis of Android devices. In this episode of Mobile Unpacked we'll focus on learning the basics up to some advanced ADB command...
ow.ly
January 28, 2025 at 3:24 PM
To start the year, and Season 3 (what?!) of Mobile Unpacked, we’re going back to basics on ADB. Come learn what makes the protocol what it is, how it works, and how you can recover information that would otherwise be lost without these valuable commands!
Suuuuuuuuuuuure. But thanks for the free malware!
December 30, 2024 at 11:25 PM
Suuuuuuuuuuuure. But thanks for the free malware!
Reposted by Christopher Vance
December 16, 2024 at 9:58 PM
Thanks to insomnia, I have now watched Hans Gruber fall from Nakitomi Tower.
Christmas has officially begun!
Christmas has officially begun!
December 15, 2024 at 8:13 AM
Thanks to insomnia, I have now watched Hans Gruber fall from Nakitomi Tower.
Christmas has officially begun!
Christmas has officially begun!
Hey Siri are you using ChatGPT?
Siri: no. But yes. Maybe. But yes.
Siri: no. But yes. Maybe. But yes.
December 13, 2024 at 6:45 AM
Hey Siri are you using ChatGPT?
Siri: no. But yes. Maybe. But yes.
Siri: no. But yes. Maybe. But yes.
Seeing 3D-printed evidence getting called out in such large cases is exactly why I did my 3D Printer artifacts research last year.
www.wired.com/story/luigi-...
www.wired.com/story/luigi-...
The ‘Ghost Gun’ Linked to Luigi Mangione Shows Just How Far 3D-Printed Weapons Have Come
The design of the gun police say they found on the alleged United Healthcare CEO's killer—the FMDA or “Free Men Don’t Ask”—was released by a libertarian group.
www.wired.com
December 11, 2024 at 6:14 AM
Seeing 3D-printed evidence getting called out in such large cases is exactly why I did my 3D Printer artifacts research last year.
www.wired.com/story/luigi-...
www.wired.com/story/luigi-...
What’s the best Christmas movie and why is it Muppet’s Christmas Carol?
In this 27-part dissertation I will explain…
In this 27-part dissertation I will explain…
December 9, 2024 at 12:24 AM
What’s the best Christmas movie and why is it Muppet’s Christmas Carol?
In this 27-part dissertation I will explain…
In this 27-part dissertation I will explain…
I think many of us are reaching the point of notification fatigue. Too many apps are constantly pinging us because we haven’t used or to show “deals.”
While I know many apps have notification tweaks, I wish the major OSes would segment notification permissions. Give me a setting for only key ones!
While I know many apps have notification tweaks, I wish the major OSes would segment notification permissions. Give me a setting for only key ones!
December 7, 2024 at 2:50 PM
I think many of us are reaching the point of notification fatigue. Too many apps are constantly pinging us because we haven’t used or to show “deals.”
While I know many apps have notification tweaks, I wish the major OSes would segment notification permissions. Give me a setting for only key ones!
While I know many apps have notification tweaks, I wish the major OSes would segment notification permissions. Give me a setting for only key ones!
Some days you just know are going to be a struggle.
Like when you try to put on a t-shirt as pants.
Like when you try to put on a t-shirt as pants.
December 3, 2024 at 1:13 PM
Some days you just know are going to be a struggle.
Like when you try to put on a t-shirt as pants.
Like when you try to put on a t-shirt as pants.
On November 27, join me for the latest Episode of Mobile Unpacked where I go over Tap-To-Pay artifacts on iOS and Android. Don’t leave valuable location data behind! www.magnetforensics.com/resources/ep...
Ep. 23 // Following the Money | Tracking Mobile Payment Artifacts - Magnet Forensics
With iOS and Android both having tap-to-pay payment functionality built in, it’s opened up a great opportunity for tracking where and how they’re using this feature.
www.magnetforensics.com
November 21, 2024 at 1:48 PM
On November 27, join me for the latest Episode of Mobile Unpacked where I go over Tap-To-Pay artifacts on iOS and Android. Don’t leave valuable location data behind! www.magnetforensics.com/resources/ep...
Just finished recording this month’s episode of Mobile Unpacked. It was a fun one that led me down several paths I hadn’t explored before!
That being said, I’m done with looking at protobufs for a while.
That being said, I’m done with looking at protobufs for a while.
November 19, 2024 at 7:11 PM
Just finished recording this month’s episode of Mobile Unpacked. It was a fun one that led me down several paths I hadn’t explored before!
That being said, I’m done with looking at protobufs for a while.
That being said, I’m done with looking at protobufs for a while.
Apple’s transfer of files/records via “the boop” (unified logs IYKYK) extends to Apple Cash. Interesting way to start paying individuals, but how about long term storage?
Passes23.sqlite still has your back.
Passes23.sqlite still has your back.
November 18, 2024 at 9:23 PM
Apple’s transfer of files/records via “the boop” (unified logs IYKYK) extends to Apple Cash. Interesting way to start paying individuals, but how about long term storage?
Passes23.sqlite still has your back.
Passes23.sqlite still has your back.
Professor: “no test or assignment this week.”
Me immediately:
Me immediately:
a man with a beard wearing a black hat says storm 's coming
ALT: a man with a beard wearing a black hat says storm 's coming
media.tenor.com
November 18, 2024 at 9:19 PM
Professor: “no test or assignment this week.”
Me immediately:
Me immediately:
For years I’ve tried to stress the importance of checking for multiple user accounts in Android. With Secure Folder and Private Space being other user accounts, ensure you are checking for these! With adb access run:
adb shell pm list users
Not all tools run commands on user profiles outside 0.
adb shell pm list users
Not all tools run commands on user profiles outside 0.
November 17, 2024 at 1:13 PM
For years I’ve tried to stress the importance of checking for multiple user accounts in Android. With Secure Folder and Private Space being other user accounts, ensure you are checking for these! With adb access run:
adb shell pm list users
Not all tools run commands on user profiles outside 0.
adb shell pm list users
Not all tools run commands on user profiles outside 0.
Hey I know that guy! It’s me!
I said what I said. Get the phone. Get the data. Delaying now will cost you more than time later.
I said what I said. Get the phone. Get the data. Delaying now will cost you more than time later.
#iOS devices are rebooting taking them from AFU to BFU.
We talk with Magnet Forensics' #DigitalForensics expert Chris Vance on what is happening and why.
Listen @dfnpodcast.bsky.social here: digitalforensicsnow.buzzsprout.com
We talk with Magnet Forensics' #DigitalForensics expert Chris Vance on what is happening and why.
Listen @dfnpodcast.bsky.social here: digitalforensicsnow.buzzsprout.com
November 15, 2024 at 5:36 PM
Hey I know that guy! It’s me!
I said what I said. Get the phone. Get the data. Delaying now will cost you more than time later.
I said what I said. Get the phone. Get the data. Delaying now will cost you more than time later.
Whew. This week sure has been a year, huh?
November 15, 2024 at 5:34 PM
Whew. This week sure has been a year, huh?