Josh Hickman

Endtroducing…Lost Apples I promise I'm OK 🙂 Earlier this year I wrote a post about Observations.db, which is a component of Apple's FindMy functionality. It was the second part of a post I had written in 2024 about rogue Bluetooth trackers and FindMy compatible devices on iOS devices. In short, FindMy data can offer examiners additional sources of location information along with information about other Apple devices that may be on a given account.

#DFIR

👀 👀 👀

Further Observations – More on iOS Search Party iOS is observing. And judging. Note: This article assumes you have read a previous article about AirTags, found here, as it references items associated with iOS searchpartyd with little to no explanation. It is highly recommend you read the previous article before proceeding. Over the past several months I have been exploring iOS’s Search Party. It is that thing…

#DFIR

(Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing Or not. Another summer has flown by. Vacations, court (yes!), classes (also, yes!), and of course the conference circuit were (and still are) all in full effect this year. Things are winding down a little and I finally have a chance to put fingers to keyboard and write about some things I have had in the works. It is getting increasingly difficult these days to find time to sit and write.

(Not) Strange Bedfellows – Samsung’s Rubin & Digital Wellbeing

Or not. Another summer has flown by. Vacations, court (yes!), classes (also, yes!), and of course the conference circuit were (and still are) all in full effect this year. Things are winding down a little and I finally have a chance to…

Week 14 – 2025 Use the discount code thisweekin4n6 for 15% off any class at Cyber5w.Use the code PM15 or click this link for 15% your next Hexordia classTakes a class with me! Akash Patel Understanding Partitioni…

Week 14 - 2025 #DFIR
thisweekin4n6.com/2025/04/06/w...

Finding Phones With Google Maps Part 1 (Android) Lost. But not. Note: there is an important update to this article. Please see the appended portion. I am a firm believer that digital forensic artifact discovery is, at times, equal parts persisten…

It’s not often that I get to revisit old research, but this has happened twice now in the past couple of months. There’s an update to my Google Maps on Android article.

"We practitioners are in a constant state of learning; our discipline requires it.”

#DFIR

thebinaryhick.blog/2023/10/17/f...

Ridin’ With Apple CarPlay 2 All I ever wanted... It is not often that I get to revisit previous research. Most, if not all, of us do research, share it (hopefully), and then move on to the next thing. There is so much to examine that it is nearly impossible to revisit things, especially in the mobile device space. When we do go back, though, it is usually because something has changed, and that is what happened here.

#DFIR

Triple Trouble. iOS 16, Android 14, and iOS 17 Images Now Available! Right as rain While it wasn’t as “soon” as I would have liked, I am (finally) pleased to announce the availability of public images of iOS 16, Android 14, and iOS 17. A few notes.…

#DFIR

thebinaryhick.blog/2024/09/14/t...

Where The Wild Tags Are & Other AirTag Stories. Accurate depiction of my test phones. Note: this post is a quasi-continuation of my previous post about Bluetooth trackers on the Google Find My Device network. While I typically write about Team G…

#DFIR

thebinaryhick.blog/2024/09/02/w...

The Green Look Back. Android’s On-Device Location History We’re at now, now. Back in December of 2023 Google announced a change to Android’s Location History feature that got quite a bit of attention. Prior to the announcement, users could vie…

#DFIR

thebinaryhick.blog/2024/06/28/t...

Not All Androids Who Wander Are Lost. A Look At Android’s Find My Device Network Where am I??? NOTE: portions of this post appeared in my presentation at the 2024 SANS DFIR Summit. Where did the summer go? August is almost behind us, but it seems like yesterday the kids got out…

Posting some of my recent articles here as I haven’t previously. #DFIR

thebinaryhick.blog/2024/08/23/n...

thebinaryhick.blog/2023/10/17/f...
#DFIR

Android & AirTags (Part II) IYKYK. Summer (and DFIR conference season) is in full swing, so things have been busy! However, an opportunity presented itself recently that I could not allow to pass: revisiting a subject I previ…

Usually helps if I actually post the article. 🤦‍♂️

https://thebinaryhick.blog/2023/08/13/android-airtags-part-ii/

Whew. Made it.