A round-up of this week’s digital forensics news and views:
Research & Techniques
SANS Expert Builds AI Framework for DFIR
Heather Barnhart, DFIR Curriculum Lead at SANS with 20+ years of experience, joins the Digital Forensics Now podcast to discuss a framework she and her team developed for applying AI in DFIR workflows. The framework addresses when and how AI should be used during investigations, offering practitioners structured guidance on a rapidly evolving topic.
Industry News
Study Tracks Psychological Toll on DFIR Analysts
A longitudinal study following digital forensics analysts over 18 months found that by the one-year mark, more than half reported disturbed sleep, intrusive thoughts, and hypervigilance extending beyond work hours. Findings challenge the assumption that screen-based investigative work carries no secondary trauma risk, placing organizational responsibility at the centre of the debate.
Legal & Policy
AI-Generated CSAM Reaches U.S. Courtrooms
An Ohio man's guilty plea under the Take It Down Act marks what is believed to be the first conviction for AI-generated child sexual abuse material, highlighting how generative AI has complicated legal standards rooted in Ashcroft v. Free Speech Coalition. An ABA article examines how focusing solely on whether a real child was involved in production may no longer capture the full range of harms synthetic imagery causes.
Research & Techniques
Amped FIVE Addresses Video Timing Analysis
Accurate timing metadata is critical to forensic video interpretation, and Amped Software outlines how its FIVE platform helps analysts assess and verify timing sources in video evidence. Reliability and authenticity preservation are highlighted as key workflow considerations.
Tools & Software
Perceptor: Open-Source Multi-System Investigation Platform
Perceptor is a new free, open-source investigation platform that ingests forensic images, tool reports, and VMs, then parses Windows artifacts and surfaces connections across multiple systems. It supports cross-system USB tracking, timeline analysis, lateral movement detection, and malware spread tracing, with an optional AI/MCP connector for querying parsed data. Community help is sought for testing and parser validation.
Industry News
Detego Platform Deployed for Wildlife Crime
Conservation NGO Freeland has adopted Detego's digital forensics platform to support investigations into wildlife trafficking networks. The deployment focuses on cross-border intelligence sharing and frontline investigator support against organised crime.
Tools & Software
Evanole VM Adds Python Tool Version Manager
Evanole VM v20260603 introduces EVM, a command-line environment version manager built on uv and Git that lets examiners update and switch Python-based forensic tools without downloading a new OVA. New additions include crush-forensics for data structure analysis and Lumyx Path Builder, a free web app for forensic timelining. Wireshark has also been optimised for nRF Bluetooth dongles.
Training & Events
Leica's Marcus Rowe on LiDAR and FEE 2026
Marcus Rowe, Business Director of Public Safety and Forensics at Leica Geosystems, discusses his career in forensic collision investigation and the growing role of LiDAR scanning in crime and crash scene documentation. He previews Forensic Expo Europe 2026 at London's Olympia, where Leica and Forensic Focus will both appear as exhibitors.
Research & Techniques
Zalo iLEAPP Parser Covers Media Artifacts
A new blog post details the Zalo parser for iLEAPP, focusing on how media artifacts are extracted and visualised within the LAVA framework. Mobile forensics examiners working cases involving this popular messaging app gain a practical walkthrough of what evidence is recoverable and how it surfaces in analysis tools.
Tools & Software
Velociraptor 0.77.1-RC1 Released for Testing
Velociraptor 0.77.1-rc1 is now available for community testing, with full release notes published on GitHub. Practitioners using the open-source DFIR platform are encouraged to test and report issues via GitHub or the project's Discord server.
