ZENA FORENSICS

Following my previous article, 84 Streams Later: Exploring the Evolution of Apple Biome , this article takes a deeper look at the work performed during the analysis, with the goal of enabling further research into the various Biome streams identified throughout the investigation. As described in the previous post, on iOS 17 and later systems, Biome streams are primarily stored in two locations:  /private/var/db/biome/streams/restricted/ /private/var/mobile/Library/Biome/streams/restricted/ The analysis of these folders across multiple devices—including personal devices, test devices, and real-world forensic acquisitions—allowed the identification of 84 streams containing information that may be of forensic interest. Based on the observed content, I categorized the streams according to the type of information they contain. To simplify the analysis, I identified five categories of information: Device State (e.g., Airplane Mode on/off, device plugged in, battery level, and similar inf...

Over the last few years, Apple's Biome framework has quietly evolved into one of the most important sources of forensic evidence available on iOS devices. While the forensic community has traditionally focused on artifacts such as KnowledgeC.db , Apple has progressively shifted a significant amount of behavioral, contextual, and predictive information into Biome. Today, most forensic analysts are aware of Biome and the SEGB/SEGBv2 file formats, and many commercial and open-source tools provide at least limited support for some of the available streams. However, after working on multiple real-world investigations, I realized that several fundamental questions remained surprisingly difficult to answer: When exactly did Apple introduce the SEGB format and the Biome framework? How did the storage locations evolve across different iOS versions? To what extent has Biome replaced KnowledgeC? How well do modern forensic tools actually support the available data? This article attempts to a...

I spend a lot of time analyzing Android devices and can process data using a variety of tools, both commercial and open source. As is well known, only by using multiple tools can one minimize errors, validate results across tools, and cover a greater number of artifacts, since each tool processes different files with different methods. During these analyses, I noticed that many SQLite databases present on Samsung Android devices are not currently parsed by most tools, even though they may contain potentially relevant information for a forensic investigation. Some databases are already supported by some applications.  However, many others deserve attention. DISCLAIMER! The test was conducted on different  Samsung devices, but the goal of this post is not to provide detailed test results, but rather to encourage research and development of new plugins or parsing modules. These databases were not found on Google Pixel, Xiaomi, Oppo, or other Android devices, and they are unique...