James McGee

@[email protected]
24 Followers
18 Following
106 Posts
SELECT
purpose.to_support as "Husband",
purpose.for_caring as "Father",
title.each_day as "Special Agent",
title.the_passion as "Digital Forensic Examiner",
hobby.one_of_many as "SQL Query Fanatic",
hobby.just_for_fun as "Sometimes I make NFTs of my dog"
FROM purpose
LEFT OUTER JOIN purpose ON purpose.rowid = title.rowid
LEFT OUTER JOIN purpose ON purpose.rowid = hobby.rowid
WHERE purpose.for_this is "Just normal things and DFIR"
Bloghttps://www.sqlmcgee.wordpress.com/
LinkedInhttps://www.linkedin.com/in/jamesrmcgee/
Twitterhttps://www.twitter.com/SQL_McGee
James McGeeMar 13
KMLer turns CSV and XLSX files into KML files while adding the investigative context examiners and analysts need. 🕵️ Horizontal accuracy visualized, extended data, processing report, and more!
Read more here: https://tinyurl.com/y8d3je3m 
Get it here: https://tinyurl.com/3fw8vnn8
James McGeeFeb 23

Couldn’t start the week better — thank you Christopher Vance for the shout-out in your session, Harping on health data, during the Magnet Virtual Summit 2026!

Your Mobile Unpacked series has helped so many of us, and it’s genuinely humbling to have my Apple Health contributions mentioned alongside it.

If you’re in digital investigations and haven’t joined the Summit yet, you still have time (Feb 23–26). It’s free, eye-opening, and full of practical takeaways:
https://lnkd.in/ew3taAjV

My own corner of Apple Health forensics lives on the Metadata Forensics company blog, The Metadata Perspective:
https://lnkd.in/e6HZCBFq

And HEART by Metadata Forensics (Health Events & Activity Reporting Tool) so the community can quickly turn Apple Health application data into usable reports. 37+ artifacts, clean HTML output, and it works on the extractions you already have.
https://lnkd.in/ehvzCCy5

Looking forward to the rest of the week and continuing the conversation with all of you.
#MVS2026 #DFIRCommunity

James McGeeNov 20
James McGeeAug 28, 2025
Thanks to our great DFIR Community and discussion on the matter, I’m happy to announce our Google Location History Takeout Parser, Version 1.4.1. We’ve added Horizontal Accuracy KMLs for Records.JSON data and Parking Events. Get it at https://tinyurl.com/4aua56u4 Google Earth example:
James McGeeFeb 13, 2025
Many thanks to Magnet Forensics, Hexordia, and the CTF authors for this great experience! Glad the timing worked out that I was able to participate - really enjoyable, creative, and challenging. Still may go back and look at some more of these questions..
James McGeeFeb 1, 2025
James McGeeNov 28, 2024
This Thanksgiving, I’m grateful for the opportunity to make a difference and help bring justice to light. It’s the small details that matter, and I’m thankful to be part of a journey that strives for truth and fairness for all. Wishing everyone a meaningful Thanksgiving!
James McGeeNov 14, 2024
Let’s discuss: unpopular opinion? iOS 18: AFU is <72 hrs from reboot and BFU state. Lot of extraction ASAP talk, regardless of search auth. You can articulate, but with auth prior you don’t have to. What am I missing? Are auths after device seizure really going beyond 24 hrs?
James McGeeNov 11, 2024
James McGeeDec 3, 2023