Ciofeca Forensics @CiofecaForensic

Monday morning solutions to put power back in the hands of the forensics examiner ciofecaforensics.com Computerville Joined October 2017

Tweets

140
Followers

242
Following

30
Likes

47

Ciofeca Forensics @CiofecaForensic

6 months ago

That time an entire state's contact tracing information was accidentally public because someone forgot to read the fine manual. ciofecaforensics.com/2025/03/02/qua…

0 0 1 38 0

Ciofeca Forensics @CiofecaForensic

7 months ago

New blog post about that time a website broke 5 of the OWASP Top-10 in just one page with one cookie. ciofecaforensics.com/2025/02/14/coo…

1 0 1 54 0

Ciofeca Forensics @CiofecaForensic

8 months ago

Happy Holidays, Apple Cloud Notes Parser now supports running directly from an encrypted iTunes backup and taking the password via command line input instead of a file on disk. github.com/threeplanetsso…

0 3 8 294 4

Ciofeca Forensics @CiofecaForensic

9 months ago

A quite delayed breakdown of the changes to NoteStore.sqlite in iOS 18 and a brief explanation of the 3-year gap in posts: ciofecaforensics.com/2024/12/10/ios…

0 1 5 269 2

Ciofeca Forensics @CiofecaForensic

4 years ago

Way later than I had hoped, but that is par for the course for 2021. Here is a look at the 25 new columns added to Apple Notes in iOS 15: ciofecaforensics.com/2021/11/08/ios…

0 3 3 0 0

Ciofeca Forensics @CiofecaForensic

4 years ago

Still need to test how it works with locked notes, but initial support for hashtags and mentions can be found in this branch: github.com/threeplanetsso…

0 0 0 0 1

Ciofeca Forensics @CiofecaForensic

4 years ago

Apple Cloud Notes Parser no longer breaks on iOS 15 Notes databases. Tomorrow hash tags and mentions should be handled in the export.

0 0 0 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Have to say I am a fan of @SANSInstitute On Demand training. Had way too much stuff going on these past 4 months, but was able to steal time to watch the #FOR572 videos at double speed, then #YOLO the #GNFA test just under the deadline. Wouldn't have had time for a week straight.

0 0 4 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 12.2 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ procdump --dump-dir=procdump -p 4480 \ && pe-tree procdump/executable.4480.exe => VS_VERSIONINFO: 11.00.9600.18858 ciofecaforensics.com/2020/12/28/mag…

0 2 4 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 12.1 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 memmap \ | grep -i 'pid\|580fa000\|85986000\|97f5f000\|11c54e000' => iexplore.exe pid: 4480 0x000000000b7fb000 0x0000000097f5f000 ciofecaforensics.com/2020/12/28/mag…

0 2 2 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 11 of #MagnetWeeklyCTF in a tweet: rekall -f memdump.mem --profile=Win7SP1x64 dns_cache \ | grep "myaccount\|www3.l." \ | awk '{print $2,$4,$5}' => myaccount.google.com CNAME www3.l.google.com www3.l.google.com A 172.217.10.238 ciofecaforensics.com/2020/12/26/mag…

0 2 8 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 10.5 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ userassist \ | grep -A 3 Chrome => REG_BINARY Chrome : Count: 9 Focus Count: 106 Time Focused: 3:36:47.301000 ciofecaforensics.com/2020/12/19/mag…

0 1 3 0 1

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 10.4 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ getsids -p 3384 \ | grep S-1-5-21 \ | cut -d \( -f 3 \ | head -n 1 => Warren ciofecaforensics.com/2020/12/19/mag…

0 0 2 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 10.3 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ dumpfiles -p 3384 --dump-dir f/ \ && sqlite3 f/file.3384.0xfffffa80311c7eb0.dat \ 'select url FROM urls ORDER BY last_visit_time DESC LIMIT 1;' => 'google.com'

0 0 2 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 10.2 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ netscan \ | grep 172.253.63.188:443 \ | awk '{print $3}' => 192.168.10.146:54282 ciofecaforensics.com/2020/12/19/mag…

0 0 1 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 10.1 of #MagnetWeeklyCTF in a tweet: volatility -f memdump.mem --profile=Win7SP1x64 \ netscan \ | awk '{print $4}' \ | grep '^[0-9][0-9][0-9].[0-9][0-9][0-9].[0-9][0-9].[0-9][0-9][0-9]:[0-9][0-9][0-9]$' => 172.253.63.188:443 ciofecaforensics.com/2020/12/19/mag…

0 0 1 0 1

Ciofeca Forensics @CiofecaForensic

5 years ago

Twiddling my thumbs and remembering the good old days of responsible disclosure when responses were measured in hours, not months. Had three good ones with Facebook back in the day, you're allowed to write them up after 13-16 years, right?

0 0 0 0 0

Ciofeca Forensics @CiofecaForensic

5 years ago

Week 9.7 of #MagnetWeeklyCTF in a tweet: strings -tx memdump.mem \ | grep wow_this_is_an_uncrackable_password => af12a2d ciofecaforensics.com/2020/12/12/mag…