forrestcook.net

Varints - because this wasn't complicated enough already

Mon, 21 Apr 2025 00:00:00 -0700

While working through the potato chat BLOBs, I was introduced to the varint concept. Effectively, a varint is a flexible way to communicate positive integers through one or more byte of data, dynamically.

Instead of an application always requiring an integer use one byte of data to convey a number (and thus being limited from 0-255), or the application always requiring some larger number of bytes to convey a larger span of integers, a varint can be used.

Potato Chat pt. 2; Starchy Boogaloo! 🥔💬

Thu, 17 Apr 2025 00:00:00 -0700

Update - 08/22/2025:

Christian Peter has continued this research into areas I have not addressed - his post is worth a read and the coming LEAPP parser is exciting news! Check out his writeup here: http://cp-df.com/en/blog/potato.html

In the last post I brought up some behaviors that I was able to test and observe within the potato chat application. While I am not done testing the application’s behaviors (there are many… so many), I have also been attempting to process the various databases and logs to make some meaningful headway into documenting user activity through the app. The two main databases I have been working with are:

Potato Chat 🥔💬

Fri, 04 Apr 2025 00:00:00 -0700

Last updated 04/24/2025

I recently became aware of the “Potato Chat” application, which my tools weren’t supporting. I decided I would take a stab at parsing the unsupported elements from the various databases and log files involved. I’ll give a rundown of the app and then we will dive into the artifacts you can find within the application files.

By setting up three devices with potato accounts and joining my own three-person group chat, I was able to simulate specific activities and document the effects. I plan on treating this post as a “living document” so that I can add new information or change older information should my research be corrected or added to.

Case Management Utility

Mon, 10 Mar 2025 00:00:00 -0700

I often find myself happily exploring rabbit holes in digital forensics, time discipline is not a strength of mine. So in order to better manage my time and enhance my productivity, the clear choice was to spend (many) hours learning Python to automate some of my day to day activities. The “Case management script” (which doesn’t manage anything, btw… I’m not good at naming things) was my first real undertaking with Python.

Warrant Builder

Sun, 17 Nov 2024 21:11:54 -0700

Creative names aside - I took it upon myself recently to attempt to streamline the warrant writing process at my agency. This endeavor took place over many months and several iterations as I stumbled forward learning Python and some pertinent libraries. Moving from quality of life automations based on command line inputs for myself, I began to learn to put together a GUI based application to modify a .docx template file. Features piled up in my brain faster than I could accomplish them through code but eventually I have gotten to a stage where the program is functional enough to share.

Don't mind the burning smell, I'm concentrating.

Thu, 18 Jul 2024 00:00:00 -0700

I picked up the domain with the intention of starting a blog of sorts related to DFIR. Of course, life gets in the way and I’ve been much busier than initially expected. I have ideas of posting research into various apps and interactions on mobile devices and computers. I’m also trying to learn python, so ultimately there will be some crossover between this site and my GitHub.

Posts will likely be intermittent, I will try to limit myself to ideas that are slightly farther along than half-baked, I can’t make any promises though.

Forrest Cook

Mon, 01 Jan 0001 00:00:00 +0000

" alt=“Profile Photo” class=“avatar avatar-8 rounded-full mb-3”>

A detective based in Arizona working in digital forensics

Current Position

Oro Valley Police Department - Digital Forensics Detective

Career

2021 - Present: Cellebrite Contract Trainer
2018 - Present: Digital Forensics Detective
2012 - 2018: Plain-clothes assignment
2006 - 2012: Patrol Officer

Profiles

Hobbies

Tinkering

I have a small collection of Raspberry Pi, Arduino and ESP32 gadgets lying about in a “good intentions” pile… Waiting for the day I finish a project. I’m also learning FreeCAD and 3D Printing lots of definitely useful things.