On-Demand Webinars

Take it or Leave it: Triaging Digital Evidence with MacQuisition

A Deep Dive into Keychain and Spotlight Artifacts: Ask the BlackBag Experts

New Triage Capabilities in BlackLight

Whodunit: Identifying Suspects Through Digital Evidence

Windows 10 Activity Timeline: An Investigator's Gold Mine

What's New in BlackLight 2019 R2

Physical Decrypted Images from Macs with the T2 Chip

Detecting Image Categories

Protecting the Innocent

Timesaving Forensic Techniques

Finding Insider Threats

Ask the Expert

BlackLight and APOLLO: How to Use Apple Pattern-of-Life Data in Your Investigations

So, you’ve downloaded MacQuisition Live, let’s take a look at some ways you can use it. Read More...

Apple’s iCloud Drive is a valuable means of storing data in the cloud and making it accessible to all your iCloud connected devices.  However, users were unable to share data directly from their iCloud Drive to other users; that is until recently. With the release of macOS10.15.4 and iOS13.4, users can now select files and folders within their iCloud Drive and share them directly with other users. Read More...

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac systems without having to send MacQuisition hardware to someone’s home. In order to help our customers in this unique time, BlackBag is making a new software only option available to MacQuisition customers for a limited time. Read More...

The Timeline is a Windows 10 facility for tracking many types of user activity so that it can remind the user what they’ve been up to, and let them simply click a UI tile to resume one of those previous activities, e.g., open a browser up to a webpage the user previously visited. Read More...

The system configuration that affects the Timeline is complex, but the data is generally stored for the past 30 days, more if you leverage Volume Shadow Copies (VSCs) and backups. Also, depending on configuration, the Timeline on one machine can store this same information about a user’s actions on other machines! Some of the data can even come from other devices that run OSs other than Windows (for instance, Android and macOS). Needless to say, a lot going on here. Read More...

While I was researching the Apple Notes application on macOS and iOS, I came across peculiar scenarios where “secure” notes were partially and temporarily unsecure. This provides forensic analysts the opportunity to peek into these notes to potentially gather more information about the contents of them, which can potentially benefit your investigations. These examples are from macOS 10.15.3 and iOS 13.3. Read More...

Today’s investigations often involve multiple machines and devices.  It can be time consuming to image and process several computers, external hard drives, and other media when there is no guarantee data of relevance will be located on these devices.  Imaging multiple macOS computers and external media devices that may or may not contain data relevant to an investigation can waste time, storage space, and other resources.  MacQuisition triage capabilities provide access to a new methodology that can decrease the number of devices you need to acquire while increasing your overall efficiency. Read More...

As Windows has evolved over time several artifacts have appeared that can highlight when programs or applications were executed, and which user executed them. Read More...

With the recent news of BlackBag joining Cellebrite, it seems like the appropriate time to share what we can already do together! Specifically, how to ingest Cellebrite acquisitions into BlackLight. With our latest BlackLight release, BlackBag added additional Cellebrite formats that can be added directly to BlackLight. Our goal is to have Blacklight fully support all Cellebrite extraction types in a future release. In this post, we wanted to share some additional steps you may need to support additional formats and make it as easy as possible until all file formats are fully supported. Read More...