Julian Derry

Verified account

@CyberSamuraiDev

Licensed Digital Forensics Analyst & Investigator Mobile & Computer || I break down what devices don’t forget

SHA-256

Joined April 2015

869 Following

13K Followers

5.7K Posts

Pinned Tweet

@CyberSamuraiDev

3 months ago

A Deep Dive into Mobile Forensics I recently completed a full mobile forensic analysis on an iPhone 13 Pro and it was a powerful reminder of how much a device actually remembers. This was an advanced logical extraction with verified image integrity. Even without diving into content, the metadata alone told a story. From location artifacts, I reconstructed where the device had been, the routes it traveled and the exact timestamps tied to those movements. But more importantly, I could see how those locations were generated. Some coordinates were tied to ride activity such as uber and bolt. Others came from navigation searches. Some were linked to shared live locations inside messaging apps. Each source leaves a different footprint. A searched address tells a different story than an active trip. A shared live location suggests intentional disclosure. The coordinates are only part of it, the behavior behind them is the real evidence. The “most visited locations” view made patterns obvious. Certain coordinates appeared repeatedly, building a clear picture of routine and frequency over time. On the communication side, interaction volume alone highlighted the primary contacts. Without even reading conversations, it was immediately clear who the highest frequency messaging relationships were. Volume builds pattern. Pattern builds context. Call analysis went just as deep. Even when call entries were deleted, I could still determine whether interactions were audio or video, which platform they occurred on, how long they lasted, and whether they were answered, missed or rejected. Deleting a visible log doesn’t erase the underlying artifacts. I was also able to recover delivered media, expired content, deleted messages and metadata tying everything to specific timestamps and user actions. Here’s what stands out. Phones don’t just store content. They store behavior. They store routine. They store intent. Files can be deleted. Logs can be cleared. But the artifacts remain. #digitalforensics #DFI #mobileforensics #cybersecurity

CyberSamuraiDev's tweet photo. A Deep Dive into Mobile Forensics

I recently completed a full mobile forensic analysis on an iPhone 13 Pro and it was a powerful reminder of how much a device actually remembers.

This was an advanced logical extraction with verified image integrity. Even without diving into content, the metadata alone told a story.

From location artifacts, I reconstructed where the device had been, the routes it traveled and the exact timestamps tied to those movements. But more importantly, I could see how those locations were generated.

Some coordinates were tied to ride activity such as uber and bolt. Others came from navigation searches. Some were linked to shared live locations inside messaging apps.

Each source leaves a different footprint. A searched address tells a different story than an active trip. A shared live location suggests intentional disclosure. The coordinates are only part of it, the behavior behind them is the real evidence.

The “most visited locations” view made patterns obvious. Certain coordinates appeared repeatedly, building a clear picture of routine and frequency over time.

On the communication side, interaction volume alone highlighted the primary contacts. Without even reading conversations, it was immediately clear who the highest frequency messaging relationships were. Volume builds pattern. Pattern builds context.

Call analysis went just as deep. Even when call entries were deleted, I could still determine whether interactions were audio or video, which platform they occurred on, how long they lasted, and whether they were answered, missed or rejected. Deleting a visible log doesn’t erase the underlying artifacts.

I was also able to recover delivered media, expired content, deleted messages and metadata tying everything to specific timestamps and user actions.

Here’s what stands out. Phones don’t just store content. They store behavior.
They store routine. They store intent.
Files can be deleted. Logs can be cleared. But the artifacts remain.

#digitalforensics #DFI #mobileforensics #cybersecurity

CyberSamuraiDev's tweet photo. A Deep Dive into Mobile Forensics

I recently completed a full mobile forensic analysis on an iPhone 13 Pro and it was a powerful reminder of how much a device actually remembers.

This was an advanced logical extraction with verified image integrity. Even without diving into content, the metadata alone told a story.

From location artifacts, I reconstructed where the device had been, the routes it traveled and the exact timestamps tied to those movements. But more importantly, I could see how those locations were generated.

Some coordinates were tied to ride activity such as uber and bolt. Others came from navigation searches. Some were linked to shared live locations inside messaging apps.

Each source leaves a different footprint. A searched address tells a different story than an active trip. A shared live location suggests intentional disclosure. The coordinates are only part of it, the behavior behind them is the real evidence.

The “most visited locations” view made patterns obvious. Certain coordinates appeared repeatedly, building a clear picture of routine and frequency over time.

On the communication side, interaction volume alone highlighted the primary contacts. Without even reading conversations, it was immediately clear who the highest frequency messaging relationships were. Volume builds pattern. Pattern builds context.

Call analysis went just as deep. Even when call entries were deleted, I could still determine whether interactions were audio or video, which platform they occurred on, how long they lasted, and whether they were answered, missed or rejected. Deleting a visible log doesn’t erase the underlying artifacts.

I was also able to recover delivered media, expired content, deleted messages and metadata tying everything to specific timestamps and user actions.

Here’s what stands out. Phones don’t just store content. They store behavior.
They store routine. They store intent.
Files can be deleted. Logs can be cleared. But the artifacts remain.

#digitalforensics #DFI #mobileforensics #cybersecurity

CyberSamuraiDev's tweet photo. A Deep Dive into Mobile Forensics

I recently completed a full mobile forensic analysis on an iPhone 13 Pro and it was a powerful reminder of how much a device actually remembers.

This was an advanced logical extraction with verified image integrity. Even without diving into content, the metadata alone told a story.

From location artifacts, I reconstructed where the device had been, the routes it traveled and the exact timestamps tied to those movements. But more importantly, I could see how those locations were generated.

Some coordinates were tied to ride activity such as uber and bolt. Others came from navigation searches. Some were linked to shared live locations inside messaging apps.

Each source leaves a different footprint. A searched address tells a different story than an active trip. A shared live location suggests intentional disclosure. The coordinates are only part of it, the behavior behind them is the real evidence.

The “most visited locations” view made patterns obvious. Certain coordinates appeared repeatedly, building a clear picture of routine and frequency over time.

On the communication side, interaction volume alone highlighted the primary contacts. Without even reading conversations, it was immediately clear who the highest frequency messaging relationships were. Volume builds pattern. Pattern builds context.

Call analysis went just as deep. Even when call entries were deleted, I could still determine whether interactions were audio or video, which platform they occurred on, how long they lasted, and whether they were answered, missed or rejected. Deleting a visible log doesn’t erase the underlying artifacts.

I was also able to recover delivered media, expired content, deleted messages and metadata tying everything to specific timestamps and user actions.

Here’s what stands out. Phones don’t just store content. They store behavior.
They store routine. They store intent.
Files can be deleted. Logs can be cleared. But the artifacts remain.

#digitalforensics #DFI #mobileforensics #cybersecurity

CyberSamuraiDev's tweet photo. A Deep Dive into Mobile Forensics

I recently completed a full mobile forensic analysis on an iPhone 13 Pro and it was a powerful reminder of how much a device actually remembers.

This was an advanced logical extraction with verified image integrity. Even without diving into content, the metadata alone told a story.

From location artifacts, I reconstructed where the device had been, the routes it traveled and the exact timestamps tied to those movements. But more importantly, I could see how those locations were generated.

Some coordinates were tied to ride activity such as uber and bolt. Others came from navigation searches. Some were linked to shared live locations inside messaging apps.

Each source leaves a different footprint. A searched address tells a different story than an active trip. A shared live location suggests intentional disclosure. The coordinates are only part of it, the behavior behind them is the real evidence.

The “most visited locations” view made patterns obvious. Certain coordinates appeared repeatedly, building a clear picture of routine and frequency over time.

On the communication side, interaction volume alone highlighted the primary contacts. Without even reading conversations, it was immediately clear who the highest frequency messaging relationships were. Volume builds pattern. Pattern builds context.

Call analysis went just as deep. Even when call entries were deleted, I could still determine whether interactions were audio or video, which platform they occurred on, how long they lasted, and whether they were answered, missed or rejected. Deleting a visible log doesn’t erase the underlying artifacts.

I was also able to recover delivered media, expired content, deleted messages and metadata tying everything to specific timestamps and user actions.

Here’s what stands out. Phones don’t just store content. They store behavior.
They store routine. They store intent.
Files can be deleted. Logs can be cleared. But the artifacts remain.

#digitalforensics #DFI #mobileforensics #cybersecurity

62

2K

297

2K

134K

@CyberSamuraiDev

about 9 hours ago

@h4ruk7 @mrphilghana Don’t forget me, slide me steps sensei

2

1

0

0

346

@CyberSamuraiDev

about 24 hours ago

@Profetavmg It’s very safe

0

0

0

0

9

@CyberSamuraiDev

1 day ago

I choose to understand rather than judge. It helps me both personally and as a Digital Forensics Examiner.

1

4

1

0

233

Who to follow

Making pictures speak better than words.

Felix Gyasi Nuamah 📸

CAF accredited Photographer 📸| IG: Supreme Pixels | Write & talk Sports | Tweets are solely my views #MUFC 🔴⚪️ #BTFC 🟢⚪️ 🇬🇭🇳🇬

Photographer & Creative director at KONTIHENE IMAGES, LLC

@CyberSamuraiDev

1 day ago

@koboateng @__darth_ how old are you again? 🤣

2

2

1

0

2K

@CyberSamuraiDev

1 day ago

@prettycyb3rgirl 🤣

0

1

0

0

15

@CyberSamuraiDev

1 day ago

@prettycyb3rgirl done

1

0

0

0

221

@CyberSamuraiDev

2 days ago

@michel_appau15 @koboateng @TheUltimate_09 🤣

0

0

0

0

37

@CyberSamuraiDev

2 days ago

@koboateng @TheUltimate_09 I know you see it now 🤣

0

4

1

0

609

@CyberSamuraiDev

2 days ago

@koboateng @TheUltimate_09 You sound like RILEY FREEMAN with that “infinite access to all kinds of booty.” 🤣

2

4

1

0

1K

@CyberSamuraiDev

2 days ago

Because we’re in the era of NTFS, If you want to find low level metadata on windows, look into these two indexes $J and $I30. Goldmines if you ask me.

@CyberSamuraiDev

2 days ago

Deleted doesn’t always mean gone and that’s absolutely true. Traditional file recovery often relies on filesystem metadata. File carving on the other hand doesn’t. It searches raw storage for file signatures and reconstructs data even when filesystem information is missing or corrupted. File carving is the closest thing forensic investigators have to a cheat code.

1

9

3

0

2K

0

4

0

4

569

@CyberSamuraiDev

2 days ago

@prettycyb3rgirl 🥂

0

0

0

0

32

@CyberSamuraiDev

2 days ago

Deleted doesn’t always mean gone and that’s absolutely true. Traditional file recovery often relies on filesystem metadata. File carving on the other hand doesn’t. It searches raw storage for file signatures and reconstructs data even when filesystem information is missing or corrupted. File carving is the closest thing forensic investigators have to a cheat code.

Damilola Ashiedu | Pretty Cyber Girl 💻💡

@prettycyb3rgirl

2 days ago

Most people think deleted files are gone. not exactly. i watched someone "securely" clean a laptop before selling it. they deleted files. emptied recycle bin. factory reset. felt safe. the buyer recovered documents anyway. photos. PDFs. old browser exports. even fragments of spreadsheets. here's what surprises people: deleting a file usually doesn't immediately destroy the data. many systems just mark the storage space as available. until new data overwrites it. that's why file recovery software exists. and why incident responders sometimes recover evidence people thought disappeared months ago. "deleted" and "unrecoverable" are not the same thing.

9

25

6

6

2K

1

9

3

0

2K

@CyberSamuraiDev

2 days ago

@drtosinafowowe @prettycyb3rgirl I don’t but i’ll make one

1

1

0

0

13

@CyberSamuraiDev

2 days ago

@drtosinafowowe @prettycyb3rgirl You should look into secure wiping

1

1

0

0

23

CyberSamuraiDev retweeted

Damilola Ashiedu | Pretty Cyber Girl 💻💡

@prettycyb3rgirl

2 days ago

Most people think deleted files are gone. not exactly. i watched someone "securely" clean a laptop before selling it. they deleted files. emptied recycle bin. factory reset. felt safe. the buyer recovered documents anyway. photos. PDFs. old browser exports. even fragments of spreadsheets. here's what surprises people: deleting a file usually doesn't immediately destroy the data. many systems just mark the storage space as available. until new data overwrites it. that's why file recovery software exists. and why incident responders sometimes recover evidence people thought disappeared months ago. "deleted" and "unrecoverable" are not the same thing.

9

25

6

6

2K

@CyberSamuraiDev

2 days ago

@prettycyb3rgirl Welcome to my domain, bankai 😌

1

4

0

0

253

@CyberSamuraiDev

4 days ago

@h4ruk7 PRESS ANYWHERE TO CLOSE 😭

2

1

0

0

141

@CyberSamuraiDev

4 days ago

@h4ruk7 STATUS: TARGET FULLY IDENTIFIED CLOSING BACKDOOR CONNECTION… SAFE. 😭

1

2

0

0

553

@CyberSamuraiDev

5 days ago

Dropped the call on those losers

0

1

1

0

107

Last Seen Users on Sotwe

Trends for you

Most Popular Users