Shared with You Syndication Photo Library – Message Attachments & Linked Assets

The Shared with You is a new feature that has been discussed within Apple Worldwide Developers Conference (WWDC) videos and other developer videos. Generally, the comments made indicate that within iOS and other Apple Operating Systems this feature will allow a user to easily view and interact with links that have been shared by otherContinue reading “Shared with You Syndication Photo Library – Message Attachments & Linked Assets”

Vehicle and iPhone Speed Comparison

As I stated in the future considerations section of the original research write-up, I contacted a few vehicle forensics experts and asked if they would like to assist me with some research and testing, they responded “Absolutely.” During a training event, the experts and I conducted a small test. Forensic Question During the test, IContinue reading “Vehicle and iPhone Speed Comparison”

Photos.sqlite Queries – Original Blog Posting

Hello everyone! Back in August 2020, I wrote a blog “Using Photos.Sqlite to show the relationships between photos and the application they were created with?” which was posted on Heather Mahaliks’ blog, The writeup was eventually sent to DFIR Review ( and published on their website. This is a follow-up to the aforementioned blogContinue reading “Photos.sqlite Queries – Original Blog Posting”

iOS KnowledgeC.db Notifications

Cell phone use is routine. Our cell phones are really an extension of ourselves. We carry them around to not only make calls and messages, but they are also our daily planners, to do lists and entertainment resources. We use them at all times of the day – the alarms in the morning, email, andContinue reading “iOS KnowledgeC.db Notifications”

iPhone Device Speeds via Cache.sqlite > ZRTCLLOCATIONMO table

Have you ever wanted to know how fast a vehicle or person was traveling at a particular time? Have you considered acquiring iPhone data to answer that question? The material in this blog will help provide some tools and methods for answering these questions. We know from previously published research that Apples iOS location dataContinue reading “iPhone Device Speeds via Cache.sqlite > ZRTCLLOCATIONMO table”


Hello Everyone, My name is Scott Koenig. I have been working in law enforcement for more than 15 years. In 2016, I decided it would be a good idea to become a digital forensic examiner. Since that time, I have attended several hours of training and earned several levels of certifications, but nothing has taughtContinue reading “Introduction”