A round-up of this week’s digital forensics news and views:
Tools & Software
Memory Forensics Framework Wins DFRWS Best Paper
A memory forensics framework designed to detect and analyze Go malware at runtime won Best Paper at DFRWS USA 2026 in Arlington, Virginia. Developed by Hala Ali (VCU) with Volatility core developer Andrew Case, it recovers runtime artifacts including credentials, encryption data, C2 information, and live execution state from ransomware, backdoors, RATs, and exfiltration tools.
Research & Techniques
iOS Notification Metadata Database Yields Forensic Evidence
Researcher Mattia Epifani has identified notificationAndSuggestionDB.db within Apple's DuetExpertCenter framework as a previously overlooked forensic artifact, present across iOS 15 through iOS 26. The SQLite database stores 60+ days of notification metadata — including BundleIDs, timestamps, thread identifiers, and phone numbers for WhatsApp, Signal, SMS, and calls — without preserving message content. A dedicated parser has already been added to the iLEAPP open-source project.
Read more (blog.digital-forensics.it)
Industry News
Cellebrite Brings Digital Forensics Tools to Frontline Investigations
Cellebrite's Matt Goeckel argues that centralised lab models can't keep pace with the volume of digital evidence now seized at checkpoints, booking desks, and remote offices. He says bringing forensic capabilities closer to the point of contact can speed up triage and investigations, while complex analysis and evidential review remain with trained specialists.
Tools & Software
SEGB Hunter Tool Targets iOS Biome Streams
Kevin Pagano has released SEGB Hunter, an open-source script that traverses iOS full filesystem extractions to enumerate and parse SEGB Biome streams — the emerging replacement for KnowledgeC entries. The tool extracts stream categories, record counts, modified timestamps, and tombstone status, outputting to CSV or SQLite, and accepts zip, tar, or folder input. It is available now on GitHub at stark4n6/script-stash.
Research & Techniques
Reading Apple Unified Log by Evidential Strength
A forensic researcher presents a structured methodology for analysing the Apple Unified Log by evidential strength rather than chronological order, anchoring reconstructions on sensor-level entries — such as TrueDepth face-detection frames — that users cannot consciously trigger. Verified biometric sequences are ranked above passcode unlocks, which in turn outrank automatic system events, with proximity in time treated as a hint rather than proof. The post explicitly limits conclusions to what the log can establish, stopping short of asserting device ownership from a Face ID match.
Industry News
Belkasoft X Adds AI-Powered Search Across Digital Media Evidence
Digital forensic investigators can use AI-assisted analysis to make large volumes of media evidence searchable through audio transcription, image descriptions, OCR, classification, facial recognition and video key-frame analysis. The approach is designed to reduce manual review while keeping case data processed locally, although AI-generated findings still require human verification.
Research & Techniques
Copilot and Gemini Leave Forensic Artifacts Behind
Browser-integrated AI assistants like Copilot and Gemini persist conversational state across IndexedDB stores, Service Worker caches, and legacy ESE databases — artifacts that most existing browser forensic tools were never designed to parse. Specific file paths, Python extraction snippets for LevelDB and ESE databases, and cross-artifact correlation guidance are provided for both Edge and Chrome. Standard "clear browsing data" actions frequently leave recoverable fragments, and malicious extensions have already been documented harvesting LLM chat histories from these same stores.
Tools & Software
ALEAPP Gains 28 New Android Browser Artifacts
ALEAPP now integrates Mister Skinnylegs (MSL), an open framework developed by Alex Caithness and CCL Solutions Group for parsing web and browser artifacts from Chromium-based browsers and webviews. The integration adds 28 new artifact types — including LevelDB local/session storage, browsing history, downloads, and app-specific data from Binance, Discord, ChatGPT, and others. Because artifacts are generated at runtime from installed MSL plugins, ALEAPP will automatically expand coverage as the Skinnylegs project grows.
Research & Techniques
Modern Conversation Index Forensics Decoded
Arman Gungor's follow-up analysis details how 'modern' Conversation Index MAPI properties differ structurally from classic variants, with critical implications for email timestamp forensics. Header timestamp precision drops to ~1.68 seconds, and child block time deltas now calculate from a synthetic 'base timestamp,' introducing silent 57-year overflow cycles examiners must manually account for.
Legal & Policy
Podcast Tackles Daubert and Proposed FRE 707
A new podcast episode breaks down the Daubert standard and the proposed Federal Rule of Evidence 707, both of which govern how digital forensic expert testimony is evaluated in court. Understanding these standards is essential for examiners who testify, as admissibility rulings can determine whether forensic findings ever reach a jury.
Case Studies
Tengu Botnet Weaponizes Watchdog to Destroy Forensic Evidence
Nozomi Networks has disclosed Tengu, a Mirai variant that exploits the hardware watchdog timer in routers and IP cameras to force a reboot the moment a responder kills its process — wiping volatile memory, running process lists, and in-memory artifacts. Tengu also uses memfd_create to run entirely from RAM, impersonates a system daemon, and corrupts reboot utility ELF headers to hamper recovery. The watchdog technique requires no device-specific vulnerability and is replicable across virtually all embedded Linux hardware.
Case Studies
Forensic Analysis of Skout and MeetMe Databases
A new blog post examines database artifacts from Skout and MeetMe, two dating and social chat apps relevant to mobile forensic examinations. Investigators working cases involving these apps will find tool support and query-level details worth noting.
