Research
Every investigation keeps direct observations apart from interpretation, with the original artifacts published alongside.
Subscribe via RSS Browse by topicFeatured
T2 DFU restore, the ramrod pipeline, SSV sealing, and firmware Option ROMs.
Forensic and architectural study of the StarSecurityRome21G115 RAMDisk from macOS Monterey 12.6 (x86_64): boot and init, the ramrod restore engine, APFS Sealed System Volume Merkle sealing, Image4 and FDR trust, and controller firmware.
Carrier profiles, OTAUpload, sysdiagnose, and unexplained MDM records.
What four minutes of Unified Logs reveal about Apple’s network.
Apple’s kernel networking subsystem, one command at a time.
Recovering near-invisible QR codes from an iPhone photo of a screen.
Installer, recovery RAMDisk, firmware, and EFI forensics for macOS 26.6.2.