James McGee

Husband || Father || Digital Forensic Examiner || Cyber Crime Investigator || SQL Query Fanatic || Sometimes I make NFTs of my Dog

[James McGee @SQL_McGee]

Check out our newest article, Empirical Assessment of Apple Health Activity Data: Accuracy, Granularity, and Database Artifacts! Looking deeper into the cache_encryptedC.db and iOS 26 changes. 
Article: https://t.co/mft1R1Oy5f
Support updated to HEART: https://t.co/QeuclBswlX

[James McGee @SQL_McGee]

KMLer turns CSV and XLSX files into KML files while adding the investigative context examiners and analysts need. 🕵️ Horizontal accuracy visualized, extended data, processing report, and more!
Read more here: https://t.co/QGGj6SLtBQ 
Get it here: https://t.co/jnRkWey523

[James McGee @SQL_McGee]

Get it here: https://t.co/w4lEQvTQwh

[James McGee @SQL_McGee]

🚀 New Release: HEART by Metadata Forensics Version 1.3! 🚀
We’ve added Local Device Time conversions! Because most Apple Health and Fitness application artifacts are linked to the device recorded the event, the associated time zone is preserved as well. Conversions by activity!

[James McGee @SQL_McGee]

Join the free Summit (Feb 23–26) for great DFIR insights:
https://t.co/MYkkTkcRXD
Check further work on our blog:
https://t.co/PO5o43YQPh
And try HEART by Metadata Forensics (Health Events and Reporting Tool—37+ artifacts):
https://t.co/0IbCymzank

[James McGee @SQL_McGee]

Couldn't start the week better—huge thanks to @cScottVance for the shout-out in his 'Harping on health data' session at #MVS2026 Magnet Virtual Summit!
Grateful my Apple Health forensics work was mentioned alongside his Mobile Unpacked series.

[James McGee @SQL_McGee]

Ever wondered what secrets are in your Apple Contacts? 📱 iQueryContacts 🕵️ is our new advanced SQL query work for the AddressBook.sqlitedb. All the classic data plus some new info including the Chinese lunar birthday! Find out more at https://t.co/fpDSRtfF8u

[James McGee @SQL_McGee]

🧩 RowIDetective 🕵️‍♂️ formerly detailed Lagging for the Win: Querying for Negative Evidence in the sms.db. Now detecting missing messages at the end of Apple sms.db. Because every gap tells a story.
🔗 https://t.co/cStB0T9myA

[James McGee @SQL_McGee]

🚀 New release! HEART by Metadata Forensics (Health Events & Activity Reporting Tool) Version 1.1.0.0!

Now supporting TAR, DAR (some), Advanced Logical (Encrypted) Extractions, iTunes Encrypted Backups.

⬇️ Download: https://t.co/CG4HncVHVg
📖 Article: https://t.co/YTf0To7ydK

[James McGee @SQL_McGee]

HEART by Metadata Forensics (Health Events & Activity Reporting Tool)

Free tool to parse Apple Health & Fitness data from FFS Extractions.

🔍 31+ artifacts supported
📊 HTML report + CSV/PDF export

⬇️ Download: https://t.co/QeuclBswlX
📖 Article: https://t.co/eFy6QO0iXB

[James McGee @SQL_McGee]

Thanks to our great DFIR Community and discussion on the matter, I’m happy to announce our Google Location History Takeout Parser, Version 1.4.1. We’ve added Horizontal Accuracy KMLs for Records.JSON data and Parking Events. Get it at https://t.co/tpADUdvQgn Google Earth example:

[James McGee @SQL_McGee]

🚀 Google Location History Timeline Parser v 1.4 is now available! This release features multithreaded processing, time elapsed tracking, input file size calculation, and location-related files including HTML, CSV, and TXT. Available here:
https://t.co/jb65u0mVUR

[James McGee @SQL_McGee]

@KevinPagano3 Yes, it’ll have a finalization message in the window and if you check your output location there should be a Data Copy folder, CSV folder, KML folder, and a summary txt file. Is your test data personal data or available to download? Unsure the exact problem that’s happening.

[James McGee @SQL_McGee]

🚀 Google Location History Takeout Parser Version 1.3.0.0 is here! 🎉
With enhanced KML support (TimeSpans, Descriptions & LineStrings), taking your data to the next level. Continue leveraging Google Location History Takeout & Warrant Return data.
👉 https://t.co/Yl44BLVvvA

[James McGee @SQL_McGee]

@KevinPagano3 Oh wow, interesting. I’ve never seen it go above 100MB of RAM. I’ll have to look into that. Thanks!

[James McGee @SQL_McGee]

@KevinPagano3 And thus version 1.3.0.1 came to be. If you can run your data through this new version I’d appreciate it. Thanks for your help and communicating the issue!

[James McGee @SQL_McGee]

Excited for this release, best is yet to come with the LEAPPs! Fantastic project, resource, and tool

[Kevin 🤖🕵️🍺 @KevinPagano3]

New #iLEAPP 2.1.0 release is out! #DFIR https://t.co/iIhFoek2kM

[James McGee @SQL_McGee]

We’re thrilled to unveil "Legal Bytes in a Digital World," our new article series examining the intersection of law, technology, and digital forensics. In our debut piece, we explore US v. Strong - available here: https://t.co/JfNpQNBE2g Stay tuned for more!

[James McGee @SQL_McGee]

Many thanks to @MagnetForensics, @hexordia, and the CTF authors for this great experience! Glad the timing worked out that I was able to participate - really enjoyable, creative, and challenging. Still may go back and look at some more of these questions..