Dfir on forrestcook.net

Varints - because this wasn't complicated enough already

Mon, 21 Apr 2025 00:00:00 -0700

While working through the potato chat BLOBs, I was introduced to the varint concept. Effectively, a varint is a flexible way to communicate positive integers through one or more byte of data, dynamically.

Instead of an application always requiring an integer use one byte of data to convey a number (and thus being limited from 0-255), or the application always requiring some larger number of bytes to convey a larger span of integers, a varint can be used.

Potato Chat pt. 2; Starchy Boogaloo! 🥔💬

Thu, 17 Apr 2025 00:00:00 -0700

Update - 08/22/2025:

Christian Peter has continued this research into areas I have not addressed - his post is worth a read and the coming LEAPP parser is exciting news! Check out his writeup here: http://cp-df.com/en/blog/potato.html

In the last post I brought up some behaviors that I was able to test and observe within the potato chat application. While I am not done testing the application’s behaviors (there are many… so many), I have also been attempting to process the various databases and logs to make some meaningful headway into documenting user activity through the app. The two main databases I have been working with are:

Potato Chat 🥔💬

Fri, 04 Apr 2025 00:00:00 -0700

Last updated 04/24/2025

I recently became aware of the “Potato Chat” application, which my tools weren’t supporting. I decided I would take a stab at parsing the unsupported elements from the various databases and log files involved. I’ll give a rundown of the app and then we will dive into the artifacts you can find within the application files.

By setting up three devices with potato accounts and joining my own three-person group chat, I was able to simulate specific activities and document the effects. I plan on treating this post as a “living document” so that I can add new information or change older information should my research be corrected or added to.

Case Management Utility

Mon, 10 Mar 2025 00:00:00 -0700

I often find myself happily exploring rabbit holes in digital forensics, time discipline is not a strength of mine. So in order to better manage my time and enhance my productivity, the clear choice was to spend (many) hours learning Python to automate some of my day to day activities. The “Case management script” (which doesn’t manage anything, btw… I’m not good at naming things) was my first real undertaking with Python.