🧭 Three new Spotlight attributes… so far!

macOS Tahoe is quietly expanding Spotlight’s metadata attributes.

With Beta 2 just released, I’ll be digging deeper. For now, here’s what I’ve found so far.
👉 dfiros.com/2025/06/23/%...

#macOS #Tahoe #Spotlight #DigitalForensics #Apple #Forensics

New disk image format in macOS Tahoe x.com/howardnoakle...

📘 Disarming Code by Jonathan Levin is finally available 📖
If you work in reverse engineering, digital forensics, or low level system internals across Linux, Android, or Darwin (macOS and iOS), this book is sure to be for you!

🔗 www.amazon.com/dp/099105550...

#DFIR #macOS #iOS #Android #Linux

Living life on the edge of frustrations with the #AppleDeveloper Beta's. 😅 My thoughts on the visual aspect of #Apple's OS 26 family:
📱 iOS: meh
💻 macOS: love it
📺 tvOS: subtle
⌚ watchOS: plain
🕶️ visionOS: TBD

📲 It’s that time again! iOS 26 Beta just dropped—and for forensic examiners, that means new logs, artifacts, and security changes are coming. Time to dig in! 🔍 #iOS26 #DFIR #AppleForensics #DigitalForensics #WWDC25

🔐 Most iPhones already run iOS 18. That’s a challenge for #DFIR.

📱 82% of all iPhones
📊 88% of devices from last 4 years
Source: developer.apple.com/support/app-...
Forensic hurdles:
• Users enabling Lockdown Mode
• Stolen Device Protection
• USB Restricted Mode
• Auto reboot = AFU → BFU
#iOS

🚨 Cellebrite is acquiring Corellium — big news for #MobileForensics.

🧠 AI + 🧪 virtualization = new possibilities

👀 Look out for “Mirror” — a beta tool that lets you create virtual iOS replicas for analysis.

🔗 www.forbes.com/sites/thomas...

#DFIR #Cellebrite #Corellium #DigitalForensics #iOS #AI

🔍 Into Apple forensics?

I built a resource hub for macOS, iOS, iPadOS, and watchOS DFIR tools, blogs, and test images — all free and open source.
📎 start.me/p/bp5QAm/dfi...

💻 Tools from here will also be used in Hexordia’s August macOS class.
📚 learn.hexordia.com/courses/HMAC...

#DFIR #macOS #iOS

We may have to start explaining the jump from iOS 17 to iOS 26 📱

It’s a rebrand, not 9 years of change. But in court, it can sound like it. Clarity matters when timelines are questioned ⚖️

#iOS26 #macOS #iOS #DFIR #DigitalForensics #AppleForensics

APFS uses copy-on-write for metadata and most file data. When a file is modified, the new data is written to fresh blocks while the old data remains untouched until reused
Deleted data can persist in snapshots or unallocated space
#APFS #Forensics #macOS #DFIR

🎙️ Thrilled to be a guest on @arcpoint-amy.bsky.social #DFIRmas podcast! 🔍

Check it out here: t.co/KUHxGmWKid

Let me know your thoughts!

#DigitalForensics #MobileForensics #CyberSecurity #TechPodcast #Cyber #ARNG #Reserves #nationalguard #DFIR

#DFIR 💭 of the Day: #CTFs are a fantastic way to learn!

They are a great way to learn providing access to forensic images and questions that can increase and challenge your skills.

Registration is now open for the Magnet Virtual Summit 2025 CTF powered by Hexordia. youtu.be/YNEnpwoADKs