Top all-time · #25911
Yogesh Khatri
Personal blog · swiftforensics.comsecuritysystems
Yogesh Khatri's personal blog at swiftforensics.com covers security and systems. Since 2016, 3 different Hacker News readers have linked it 3 times. It is still writing: the last post was on 2026-10-01, and you can follow it by feed.
Too few sampled comments (3) to say how often HN recommends it.?
Why HN links it
HN commenters cite this blog for forensic tips on reading SQLite databases from Apple apps and on NTFS compressed-file (WOF) streams in Windows 10. Posts are cited as technical references.
Summarised by Claude from a sample of 3 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
All things forensic and security related
What Hacker News says?
It's a sqlite database so you could pull it from there: https://www.swiftforensics.com/2018/02/reading-notes-databas... I haven't tried it with Notes but with Apple's Podcast app it's a nice sqlite DB you can query.
Comment linking /2018/02/reading-notes-database-on-macos.html
on “Tired of note-taking apps”Interestingly, NTFS in Windows 10 introduces a new codec for compressed files. See http://www.swiftforensics.com/2016/10/wofcompressed-streams-...
Comment linking /2016/10/wofcompressed-streams-in-windows-10.html
on “Windows file system compression had to be dumbed down”You could achieve the same thing with sym links, which is basically what Apple does with newer versions of macOS. The main OS partition (/) is read only, essentially immutable (unless you disable SIP.) There is a writeable volume mounted on /private (in a funky way, using "firm links".) /etc, /var, /home, and a couple others are symlinks to /private/etc, /private/var, /private/home ... They do some funky stuff with…
Comment linking /2019/10/macos-1015-volumes-firmlink-magic.html
on “The Case for the /usr Merge (2012)”