James McGee

24 Followers
18 Following
108 Posts
SELECT
purpose.to_support as "Husband",
purpose.for_caring as "Father",
title.each_day as "Special Agent",
title.the_passion as "Digital Forensic Examiner",
hobby.one_of_many as "SQL Query Fanatic",
hobby.just_for_fun as "Sometimes I make NFTs of my dog"
FROM purpose
LEFT OUTER JOIN purpose ON purpose.rowid = title.rowid
LEFT OUTER JOIN purpose ON purpose.rowid = hobby.rowid
WHERE purpose.for_this is "Just normal things and DFIR"
Bloghttps://www.sqlmcgee.wordpress.com/
LinkedInhttps://www.linkedin.com/in/jamesrmcgee/
Twitterhttps://www.twitter.com/SQL_McGee

๐Ÿš€ New Release: HEART by Metadata Forensics v1.4.1.0! ๐Ÿš€

This release adds six new Apple Health application artifacts:

๐Ÿ“‹ Health Details
โค๏ธ Cardio Recovery
๐Ÿ’“ Heart Rate Variability
๐Ÿง˜ Mindful Minutes
๐ŸŒค๏ธ State of Mind
๐ŸŒฌ๏ธ Breathing Disturbances

Free to download on GitHub: https://github.com/MetadataForensics/HEART_by_Metadata_Forensics

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

GitHub
Check out our newest article, Empirical Assessment of Apple Health Activity Data: Accuracy, Granularity, and Database Artifacts! Looking deeper into the cache_encryptedC.db and iOS 26 changes.
Article: https://tinyurl.com/ae8akwm5
Support updated to HEART: https://tinyurl.com/v8zesb7h
Empirical Assessment of Apple Health Activity Data: Accuracy, Granularity, and Database Artifacts

For nearly ten years, Apple Health data has played a role in significant criminal investigations, prompting ongoing and crucial discussions about its dependability and precision. One of the earliesโ€ฆ

The Metadata Perspective
KMLer turns CSV and XLSX files into KML files while adding the investigative context examiners and analysts need. ๐Ÿ•ต๏ธ Horizontal accuracy visualized, extended data, processing report, and more!
Read more here: https://tinyurl.com/y8d3je3m 
Get it here: https://tinyurl.com/3fw8vnn8

๐Ÿš€ New Release: HEART by Metadata Forensics Version 1.3! ๐Ÿš€
Weโ€™ve added Local Device Time conversions! Because most Apple Health and Fitness application artifacts are linked to the device recorded the event, the associated time zone is preserved as well. Conversions by activity!

Get it here: https://github.com/MetadataForensics/HEART_by_Metadata_Forensics

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

GitHub

Couldnโ€™t start the week better โ€” thank you Christopher Vance for the shout-out in your session, Harping on health data, during the Magnet Virtual Summit 2026!

Your Mobile Unpacked series has helped so many of us, and itโ€™s genuinely humbling to have my Apple Health contributions mentioned alongside it.

If youโ€™re in digital investigations and havenโ€™t joined the Summit yet, you still have time (Feb 23โ€“26). Itโ€™s free, eye-opening, and full of practical takeaways:
https://lnkd.in/ew3taAjV

My own corner of Apple Health forensics lives on the Metadata Forensics company blog, The Metadata Perspective:
https://lnkd.in/e6HZCBFq

And HEART by Metadata Forensics (Health Events & Activity Reporting Tool) so the community can quickly turn Apple Health application data into usable reports. 37+ artifacts, clean HTML output, and it works on the extractions you already have.
https://lnkd.in/ehvzCCy5

Looking forward to the rest of the week and continuing the conversation with all of you.
#MVS2026 #DFIRCommunity

Ever wondered what secrets are in your Apple Contacts? ๐Ÿ“ฑ iQueryContacts ๐Ÿ•ต๏ธ is our new advanced SQL query work for the AddressBook.sqlitedb. All the classic data plus some new info including the Chinese lunar birthday! Find out more at https://github.com/MetadataForensics/iQueryContacts
GitHub - MetadataForensics/iQueryContacts: Advanced parser for Apple Contacts (AddressBook.sqlitedb) with phones, emails, addresses, social accounts, birthdays (including Chinese lunar), and group memberships.

Advanced parser for Apple Contacts (AddressBook.sqlitedb) with phones, emails, addresses, social accounts, birthdays (including Chinese lunar), and group memberships. - MetadataForensics/iQueryCont...

GitHub
๐Ÿงฉ RowIDetective ๐Ÿ•ต๏ธโ€โ™‚๏ธ formerly detailed Lagging for the Win: Querying for Negative Evidence in the sms.db. Now detecting missing messages at the end of Apple sms.db. Because every gap tells a story.
๐Ÿ”— http://github.com/MetadataForensics/RowIDetective
GitHub - MetadataForensics/RowIDetective: An update to our prior work within Lagging for the Win, now reporting all sms.db missing ROWID values up to the message sequence number.

An update to our prior work within Lagging for the Win, now reporting all sms.db missing ROWID values up to the message sequence number. - MetadataForensics/RowIDetective

GitHub

๐Ÿš€ New release! HEART by Metadata Forensics (Health Events & Activity Reporting Tool) Version 1.1.0.0!

Now supporting TAR, DAR (some), Advanced Logical (Encrypted) Extractions, iTunes Encrypted Backups.

โฌ‡๏ธ Download: tinyurl.com/v8zesb7h
๐Ÿ“– Article: tinyurl.com/94rx6vk4

HEART by Metadata Forensics (Health Events & Activity Reporting Tool)

Free tool to parse Apple Health & Fitness data from FFS Extractions.

๐Ÿ” 31+ artifacts supported
๐Ÿ“Š HTML report + CSV/PDF export

โฌ‡๏ธ Download: https://tinyurl.com/v8zesb7h
๐Ÿ“– Article: https://tinyurl.com/94rx6vk4

GitHub - MetadataForensics/HEART_by_Metadata_Forensics: This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner.

This free tool parses Apple Health and Fitness Application data from Apple iPhone extractions in a forensic manner. - MetadataForensics/HEART_by_Metadata_Forensics

GitHub