Behind The Incident

Behind The Incident – Episode 7: Sarah Edwards

This lady does not need any introduction. She is the Apple Forensic Jedi Master, although sometimes I question whether she is not more Sith than Jedi. She is the pioneer of Apollo a must-have application for Apple Forensics. This tool is the ultimate parser for lazy people and yes this is why she named it Apple Pattern of Life Lazy Output’er (APOLLO).

I was fortunate to call her a friend and a mentor. She taught me FOR 518 which is the SANS course she authors and teaches. There is a reason they say learning with SANS is like drinking from a fire hydrant. Do yourself a favour and read her blogs and watch her presentations they are worth their weight in gold. Also, she is a DFIR 4Cast winner with taking multiple categories. In this episode, we dive into the world of Apple. She also gives us spoilers into new research. You can find out more about her work at where her latest blog features ProtoBuf data. APOLLO can be downloaded from

Behind The Incident Sarah Edwards


24th July 2020 at 2:24 pm

My brother recommended I might like this blog. He was totally right. This post actually made my day. You cann’t imagine just how much time I had spent for this info! Thanks!|

Leave a Reply

Your email address will not be published. Required fields are marked *