A round-up of today’s digital forensics news and views:
Tools & Software
LSU Releases Scalpel3 for Fragmented File Recovery
LSU researchers have released Scalpel3, the first open-source tool capable of automatically reconstructing fragmented files from damaged or wiped storage media at scale. Built on a massively parallel architecture with an integrated ML model trained on 619 file types, it solved the DFRWS 2006 and 2007 grand challenges, reconstructing every fragmented file. The NSA has awarded the team $750,000 for continued development.
Research & Techniques
SOLVE-IT Catalogues GenAI Weaknesses in Forensic Workflows
DFRWS has updated the open-source SOLVE-IT knowledge base to include weaknesses and mitigations specific to GenAI-assisted digital forensics tools, covering errors such as incomplete results, false inferences, and hallucinated timelines. Error Mitigation Analysis, formalized against ASTM E3016-18, is supported by a Python script that generates worksheets for practitioners to document how workflow weaknesses have been addressed. Mitigating GenAI errors is framed as a shared responsibility between tool developers and examiners, with transparency, reproducibility, and guardrails identified as critical controls.
Case Studies
OSINT Maps Hidden CSAM Network Infrastructure
A year-long open-source investigation has mapped a single operator running DNS, mail, and hosting infrastructure for roughly 33 pro-contact pedophile domains under the isp-cx-miami.net nameserver cluster. DNS record analysis, reverse lookups, and breach data correlation exposed shared backbone servers inside FranTech Solutions AS53667, linking sites that publicly present as independent projects. Reused passwords tied anonymous forum handles to real identities within seconds using free breach-search tools.
