Cesar Quezada

Just added 11 new resources to my Apple DFIR @startme curated for the Apple ecosystem 🍎. Includes blogs, analysis tools, Apple internals, and cross-platform utilities. Suggestions welcome! 🔗 start.me/p/bp5QAm/dfiros #DFIR #AppleForensics #DigitalForensics #iOS #macOS

@DMVAdventures @PupatellaPizza > Stellina

Why didn’t y’all tell me about Stellina Pizzeria? it’s absolutely fantastic and it immediately jumped to the top of my rankings for Neapolitan style Pete. This is the best DMV Neapolitan style pizza since Pizzeria Orso in Falls Church (When chef will was there). I might go back again today lol.

@r3nzsec @startme Absolutely, it's been added! Thanks for creating and sharing a great tool!

@mc_quezada_ @startme You can add the IRFlow Timeline on your list :) github.com/r3nzsec/irflow…

Just added 11 new resources to my Apple DFIR @startme curated for the Apple ecosystem 🍎. Includes blogs, analysis tools, Apple internals, and cross-platform utilities. Suggestions welcome! 🔗 start.me/p/bp5QAm/dfiros #DFIR #AppleForensics #DigitalForensics #iOS #macOS

#winning 🥲

@jshchnz @Dimillian 🙋🏻‍♂️

Who uses Claude Code on the Mac and wants to try a crazy new app?

🧭 Three new Spotlight attributes… so far! macOS Tahoe is quietly expanding Spotlight’s metadata attributes. With Beta 2 just released, I’ll be digging deeper. For now, here’s what I’ve found so far. 👉 dfiros.com/2025/06/23/%F0… #macOS #Tahoe #Spotlight #DigitalForensics #Apple #Forensics

Introducing Phorion. A modern EDR platform purpose-built for macOS. Because security teams shouldn’t have to settle for Windows-first tools. 🛡️🍎 🧵

@PhorionTech @_calumhall Love the “mac first” approach. Definitely needed! 🔥

One platform, one mission - no compromises. We designed Phorion from the ground up for the realities of macOS environments. Created by security engineers with years of experience attacking and defending the macOS ecosystem.

I found a what I think novel approach which allowed me to list some of the content of #Lumma #Infostealer Command & Control servers with the help of left behind .DS_Store files. Blog, tool and Lumma files can be found here nexusfuzzy.medium.com/lumma-stealer-…

@NexusFuzzy Thanks for posting. It was an easy ready and enjoyed the approach you took with using .DS_Store files.

@jbradley89 In for both versions since I’m an “🍎 enthusiast” 😅.

My next book is open for pre-orders!!! I have included the first two chapters in audiobook form for free. You can listen to them now on my website or you can listen and read the sample on Apple Books. Looking forward to getting it into your hands. themittenmac.com/threat-hunting…

@theevilbit Will we get to see a walkthrough? 🤓

Since I haven't posted any exploit videos in a while, here's a macOS Tahoe LPE. 🐟

@L0Psec Thanks for putting this out! Really enjoyed the walkthrough

New RE Video: youtube.com/watch?v=3imRXE… In this video, I analyze a recent DPRK attributed Mach-O. Not a complicated sample, however does highlight some strange function calling which may interfere with static analysis. Enjoy! :)

@chibsdubbo Nice! 👏🏼

Getting close to completion on my Chief armor! #halospotlight

macOS Tahoe brings a new disk image format eclecticlight.co/2025/06/12/mac… via @howardnoakley

@XNUniverse Got mine ordered!

If you’re in the US and are looking to learn how to reverse engineer macOS, iOS, Linux or Android you’ll want to grab a copy. amazon.com/dp/0991055500?…

📘 Disarming Code by Jonathan Levin is finally available 📖 If you work in reverse engineering, digital forensics, or low level system internals across Linux, Android, or Darwin (macOS and iOS), this book is sure to be for you! 🔗 amazon.com/dp/0991055500?… #DFIR #macOS #iOS #Android #Linux #ReverseEngineering #SecurityResearch #DisarmingCode

+1 for Death Note

Living life on the edge of frustrations with the #AppleDeveloper Beta's. 😅 My thoughts on the visual aspect of #Apple's OS 26 family: 📱 iOS: meh 💻 macOS: love it 📺 tvOS: subtle ⌚ watchOS: plain 🕶️ visionOS: TBD