A round-up of this week’s digital forensics news and views:
Research & Techniques
SQLite Tips for Mobile Forensic Analysts
Sarah Edwards shares practical DB Browser for SQLite techniques drawn from daily iOS spyware investigations, covering cell colorization, epoch timestamp conversion, table navigation shortcuts, and multi-instance workflows. Her tips target analysts working with complex databases like iOS Powerlogs — a 700-plus-table dataset central to sysdiagnose-based threat hunting.
Research & Techniques
Serverless Forensics: Lambda and Azure Functions
When a cryptominer ran undetected inside AWS Lambda for months, investigators found no disk to image and no memory to dump — only CloudTrail timestamps and embedded script fragments. Forensically viable artifacts in Lambda reduce to CloudTrail data events, CloudWatch Logs, and the deployment package, none of which are retained by default. Azure Functions forensics follows the same pattern, relying on Application Insights, Storage Account history tables, and Log Analytics exports that most organizations never configure.
Research & Techniques
Decoding Signal Database on Android 15
A forensic practitioner has published a detailed walkthrough on extracting and decoding Signal’s encrypted SQLite database from an Android 15 full filesystem image, using keys recovered from the device. The post covers both message database decryption and attachment recovery — artifacts increasingly relevant when subjects are security-aware.
Read more (matthewplascencia.substack.com)
Tools & Software
iLEAPP and ALEAPP Gain AI Image Detection
iLEAPP and ALEAPP now flag AI-generated images by parsing C2PA Content Credentials and IPTC Digital Source Type metadata, giving mobile examiners a new provenance signal during review. Separately, fourteen new Biome parsers — the first fully LLM-generated artifact set — unlocked 3,668 previously unparsed rows on a clean first pass. Batch LEAPP also now surfaces which installed apps the tools currently miss, helping examiners identify coverage gaps.
Industry News
WhatsApp Forensics Survives End-to-End Encryption
End-to-end encryption protects data in transit but leaves WhatsApp artifacts fully accessible at rest — crypt15 backups, ChatStorage.sqlite, and decrypted app storage all yield evidence once filesystem access is obtained. A 2026 technical breakdown examines what survives encryption for forensic examiners, illustrated by a lawful-intercept case involving 200 Italian devices.
Tools & Software
Tool Automates Multiple Volatility 3 Plugins Simultaneously
A new 13Cubed episode demonstrates a tool that runs multiple Volatility 3 plugins in parallel, automating memory analysis workflows. Reducing manual plugin execution speeds up investigations and frees examiners to focus on artifact interpretation rather than repetitive tooling steps.
Research & Techniques
macOS Collector v1.6.1 Adds New Telemetry Artifacts
LETHAL-FORENSICS has released macos-collector v1.6.1, adding Biome App.MenuItem data collection, System Firmware Version, Security Policy capture, and macOS 27 Golden Gate support. The entire codebase has been validated with the ShellCheck linter for POSIX compliance and production-grade reliability.
Research & Techniques
Windows Persistence Artifacts: What They Prove and Don’t
A forensic methodology post breaks down how Windows persistence artefacts—services, scheduled tasks, and autoruns—prove system configuration, not execution, a distinction that trips up many analysts. It walks through how to separate the existence of a persistence mechanism from evidence it fired, and from any downstream impact. Registry paths, parsing tools, and key fields are included for offline and live analysis.
Tools & Software
MalChela 4.2 Adds Mac Bundle Triage
MalChela 4.2 brings native .app bundle support to four analysis tools — macho_info, codesign_check, plist_analyzer, and mstrings — eliminating the manual step of locating binaries inside Contents/MacOS/. A new Analyze module auto-classifies files and dispatches all relevant tools in one pass, generating a consolidated triage report with MITRE ATT&CK mappings, VirusTotal verdicts, and structural indicators like RPATH entries and Team ID mismatches.
Read more (bakerstreetforensics.com)
Tools & Software
TraceQuarry Structures Linux Artefacts Into DFIR Timelines
TraceQuarry, an open-source tool from Chill Ethical People, consolidates fragmented Linux artefacts — authentication logs, shell history, persistence indicators, network state — into UTC-normalised CSV and JSONL investigation timelines. It supports multi-host correlation, MITRE ATT&CK tagging, IoC matching, and flags missing evidence sources to prevent absent telemetry from being misread as a clean finding.
Training & Events
Forensics Europe Expo 2026 Recap Published
Forensics Europe Expo 2026 highlighted the expanding evidential value of everyday connected devices, from video doorbells and smart toys to games consoles, while stressing the need for skilled examiners to look beyond automated tool outputs. The event also focused on the growing threat of AI-generated media, with speakers warning that deepfakes are undermining trust in digital evidence even as new detection and forensic technologies evolve in response.
