United States
| No | Text |
| 1 | Yogesh khatri's forensic blog |
| No | Text |
| 1 | Pages |
| 2 | Sunday, july 19, 2020 |
| 3 | Tuesday, june 9, 2020 |
| 4 | Monday, march 30, 2020 |
| 5 | Sat****ay, march 28, 2020 |
| 6 | Wednesday, january 8, 2020 |
| 7 | Usagestats |
| 8 | Monday, october 28, 2019 |
| 9 | Sat****ay, october 26, 2019 |
| 10 | Search blog |
| 11 | Blog archive |
| No | Text |
| 1 | Ktx to png in python for ios snapshots |
| 2 | Ktx |
| 3 | Screentime notifications in catalina (10.15) |
| 4 | Parsing unknown protobufs with python |
| 5 | Google search & personal a***istant data on android |
| 6 | Usagestats on android 10 (q) |
| 7 | Macos 10.15 volumes & firmlink magic |
| 8 | Part 3 - adb keyvalue backups - wifi and system settings |
| No | Text |
| 1 | Attempt 1 - rendering & export |
| 2 | Attempt 2 - convert texture data to raw image data |
| No | Text |
| 1 | glInternalFormat |
| 2 | 0x93B0 |
| 3 | COMPRESSED_RGBA_ASTC_4x4 |
| 4 | astc_decomp |
| 5 | <xx>/<yyyyyy> |
| 6 | DARWIN_USER_DIR |
| 7 | record |
| 8 | SELECT |
| 9 | (SELECT identifier FROM app WHERE app.app_id=record.app_id) as app, |
| 10 | uuid, data, presented, delivered_date |
| 11 | FROM record |
| 12 | data |
| 13 | t**l |
| 14 | subt |
| 15 | body |
| 16 | %@ |
| 17 | raw |
| 18 | wire types |
| 19 | decode_message |
| 20 | /data/system/usagestats/ |
| 21 | protoc --decode_raw < 1572840777639 |
| 22 | platform_frameworks_base/core/proto/android/server/usagestatsservice.proto |
| 23 | protoc -I= |
| 24 | --python_out= |
| 25 | / |
| 26 | Macintosh HD (2) |
| 27 | Macintosh HD - Data |
| 28 | /bin |
| 29 | /sbin |
| 30 | /usr (2) |
| 31 | /System (2) |
| 32 | /usr/share/firmlinks |
| 33 | /./fseventsd |
| 34 | fseventsd |
| 35 | /System/Volumes/Data |
| 36 | /apps/com.android.providers.settings/k/com.android.providers.settings.data |
| 37 | system |
| 38 | secure |
| 39 | global |
| 40 | locale |
| 41 | lock_settings |
| 42 | softap_config |
| 43 | network_policies |
| 44 | wifi_new_config (2) |
| 45 | com.android.providers.settings.data |
| No | Text |
| 1 | Figure - Ascii view of 010 hex editor with ktx template |
| 2 | glInternalFormat |
| 3 | 0x93B0 |
| 4 | COMPRESSED_RGBA_ASTC_4x4 (2) |
| 5 | astc_decomp |
| 6 | Figure 2 - Embedded plist for screentime notification |
| 7 | WeeklyReportNotificationNegativeDeltaBody |
| 8 | "Your screen time was down %@ last week, for an average of %@ a day." |
| 9 | 15% |
| 10 | 6 hours, 24 minutes |
| 11 | "Your screen time was down 15% last week, for an average of 6 hours, 24 minutes a day." |
| 12 | Figure 3 - Snippet of Localizable.strings plist |
| 13 | WeeklyReportNotificationt**le |
| 14 | Weekly Report Available |
| 15 | protoc.exe (3) |
| 16 | Figure - Allowed wire types fromhttps://developers.google.com/protocol-buffers/docs/encoding#structure |
| 17 | protoc (2) |
| 18 | string |
| 19 | bytes |
| 20 | Length-delimited |
| 21 | varint |
| 22 | addressbook.proto |
| 23 | tester_pb |
| 24 | types |
| 25 | str |
| 26 | The Google app keeps you in the know about things that matter to you. Find quick answers, explore your interests, and stay up to date with Discover. The more you use the Google app, the better it gets. Search and browse: - Nearby shops and restaurants - Live sports scores and schedules - Movies times, casts, and reviews - Videos and images - News, stock information, and more - Anything you’d find on the web |
| 27 | Figure 1 - Google Search / Personal a***istant Bar |
| 28 | Figure 2 - Folder 'recently' has no entries when no account was logged on. |
| 29 | Figure 3 - Folder 'recently' has files when searches were performed after logging in |
| 30 | [email protected] |
| 31 | If you aren't familiar with protobuf decoding, read this. |
| 32 | Figure 4 - Screenshot of search for"dolphin" |
| 33 | Figure 5 - Screenshot for news article clicked from link in google app |
| 34 | Figure 6 - .binarypb files |
| 35 | Figure 7 - ALEAPP output showing Google App / Personal a***istant queries |
| 36 | Figure 1 - File 1572840777639 - raw hex view (complete file not shown) |
| 37 | ..a language-neutral, platform-neutral extensible mechanism for serializing structured data. |
| 38 | Figure 2 - XML usagestats snippet |
| 39 | Figure 3 - aosp source code on github |
| 40 | Figure 4 - usagestatsservice.proto file snippet |
| 41 | your_proto_file |
| 42 | package = com.android.settingspackage_index: 58last_time_active_ms: 663647total_time_active_ms: 4897app_launch_count: 3last_time_service_used_ms: -1572840673324last_time_visible_ms: 673237total_time_visible_ms: 25221 |
| 43 | config { |
| 44 | font_scale: 1.0 |
| 45 | locales { |
| 46 | language: "en" |
| 47 | country: "US" |
| 48 | } (5) |
| 49 | screen_layout: 268435794 |
| 50 | color_mode: 5 |
| 51 | touchscreen: 3 |
| 52 | keyboard: 2 |
| 53 | keyboard_hidden: 1 |
| 54 | hard_keyboard_hidden: 1 |
| 55 | navigation: 1 |
| 56 | navigation_hidden: 2 |
| 57 | orientation: 1 |
| 58 | screen_width_dp: 411 |
| 59 | screen_height_dp: 659 |
| 60 | smallest_screen_width_dp: 411 |
| 61 | density_dpi: 560 |
| 62 | window_configuration { |
| 63 | app_bounds { |
| 64 | right: 1440 (2) |
| 65 | bottom: 2392 |
| 66 | windowing_mode: 1 |
| 67 | bounds { |
| 68 | bottom: 2560 |
| 69 | last_time_active_ms: 662163 |
| 70 | total_time_active_ms: 37 |
| 71 | count: 1 |
| 72 | package = com.google.android.apps.nexuslauncher |
| 73 | cla*** = com.google.android.apps.nexuslauncher.NexusLauncherActivity |
| 74 | task root package = com.google.android.apps.nexuslauncher |
| 75 | task root cla*** = com.google.android.apps.nexuslauncher.NexusLauncherActivity |
| 76 | type = MOVE_TO_FOREGROUND |
| 77 | time_ms: 34440 |
| 78 | On to the next artifact.. |
| 79 | Figure 1 - diskutil output showing a split Macintosh HD volume into two |
| 80 | Bi-directional wormhole in path traversal. Firmlinks are used on the system volume to point to the user data on the data volume. |
| 81 | Parent of root |
| 82 | root |
| 83 | private-dir |
| 84 | Figure 2 - Contents of root showing files from both SYSTEM and DATA |
| 85 | Read-only volume. |
| 86 | <Backup.adb> |
| 87 | They are backed up only if you specified the -keyvalue optionand are available on non-rooted devices too. |
| 88 | Yes, you can get wifi pa***words from an adb backup now! |
| 89 | Figure 1 - Snippet of Wifi saved settings from com.android.providers.settings.data showing SSIDs & pa***words |
| 90 | Figure 2 - Data from 'global' key |
| 91 | Figure 3 - Data from 'system' key |
| 92 | Figure 4 - Data from 'secure' key |
| 93 | Figure 5 - Data from 'softap_config' key |
| 94 | Figure 6 - Data from 'lock_settings' key |
| No | Text |
| 1 | This also means that if you have scripts that run across all files, they will need to be made aware that this location should be avoided to prevent duplication. |
| 2 | and are available on non-rooted devices too |
External Link Count
: 63
Nofollow Link Count
: 4
| Icon | Domain | IP | Alexa Rank |
| Spoilersguide.com | 104.18.38.101 |
1.602.803 | |
| Resumiendolo.com | 104.18.38.115 |
121.189 | |
| Stefanomontanari.net | 104.18.38.123 |
83.048 | |
| C.ai | 104.18.38.126 |
- | |
| Wynncraft.com | 104.18.38.130 |
68.641 | |
| Blogpilates.com.br | 104.18.38.155 |
377.942 | |
| Amzadvisers.com | 104.18.38.170 |
141.622 | |
| Kilibro.com | 104.18.38.175 |
7.361.646 | |
| Ssccglpinnacle.com | 104.18.38.18 |
147.399 | |
| Watercloudsolutions.com | 104.18.38.20 |
306.984 | |
| Voirfilms.club | 104.18.38.200 |
24.069 | |
| Idn889.com | 104.18.38.205 |
50.499 | |
| Birdeemag.com | 104.18.38.208 |
- | |
| Firstsitetips.com | 104.18.38.210 |
602.781 | |
| Sharejeunesse.com | 104.18.38.231 |
371.464 | |
| Cs-Goodgame.ru | 104.18.38.234 |
723.730 | |
| Reprap.org | 104.18.38.245 |
47.540 | |
| Gratflix.com | 104.18.38.29 |
- | |
| Dailycreation.in | 104.18.38.3 |
107.053 | |
| Geckopress.com | 104.18.38.32 |
1.273.941 | |
| Fullforms***ndi.com | 104.18.38.38 |
249.836 | |
| Toddbrown.me | 104.18.38.62 |
74.612 | |
| Tecnohotelnews.com | 104.18.38.7 |
225.185 | |
| Punediary.com | 104.18.38.71 |
197.108 | |
| B4Blaze.com | 104.18.38.79 |
78.355 | |
| Thefas***onspot.ca | 104.18.38.96 |
4.844.746 |