The Binary Hick
Joshua Hickman
Access and status
Cost
Free
Free to read or download at source. No account, no purchase.
Status
Current
Current as at the verification date below. Standards and tools both move — confirm at source before you rely on it.
What it is
A research blog by Joshua Hickman covering mobile and Apple-platform artifacts, timestamp semantics and the test images he builds and publishes for the community.
Who it is for, and when
Hickman's public Android and iOS test images are the reference datasets a lot of practitioners use to validate a tool before relying on it in a case, and the blog explains what is in them and how they were built. His timestamp posts are the ones to read before you testify about when something happened on a device. Most recent post 16 August 2026.
What it does not cover
It is deliberately narrow — mobile and Apple artifacts — with nothing on enterprise incident response, network forensics or ediscovery workflow.
Go to the source
Open at thebinaryhick.blog (opens in a new tab)https://thebinaryhick.blog/
Details
- Type
- Blog or channel
- Written for
- Working examinerAdvancedWorking examiner, Advanced
- Author
- Joshua Hickman
- Topics
- mobile, ios, android, macos, datasets, sqlite, timeline
- Checked at source
Related entries
A maintained index of populated mobile test images produced by Joshua Hickman and linked from his blog: Android 7 through 14, and iOS 13, 14 (with a macOS Big Sur image), 15, 16 and 17. Most are hosted by Digital Corpora, with one iOS 14 set on MediaFire.
A family of open-source Python parsers for mobile and returns data: iLEAPP for iOS logs, events and plists, ALEAPP for Android, and RLEAPP for returns and records from cloud and carrier providers. All three are released very frequently and are among the most actively maintained tools in mobile forensics.
An open-access reference to the structures underneath mobile evidence, in two parts: mobile file systems (APFS, Ext4, F2FS, QNX6) and the serialisation formats that carry app data (SQLite, property lists, Java serialization, Realm, protocol buffers), each chapter written by a specialist and each noting the forensic value of the structure.
A device-by-device walkthrough of mobile acquisition and analysis: iOS and Android internals and file systems, logical and physical extraction, app and SQLite artifacts, cloud extraction, mobile malware and reporting.
Alexis Brignoni's blog on mobile forensics and open-source tooling, closely tied to the xLEAPP family of parsers — iLEAPP, ALEAPP, RLEAPP and VLEAPP — which he maintains with others.