A round-up of today’s digital forensics news and views:
Forensic Focus News
F3 Announces Free Digital Forensics Cryptocurrency Investigation Day
F3 is running a free one-day cryptocurrency investigation workshop at the Financial Conduct Authority’s Stratford Cross venue in London on 29 October 2026, covering on-chain analysis, wallet attribution, threat intelligence and OSINT. Speakers from Addressable, zeroShadow, FTI Consulting and the FCA Digital Forensics Team will present real-world case studies, including Web3 exploits and asset recovery. A hands-on Capture the Flag session using the Addressable Spectra platform lets participants trace crypto artefacts and link wallets to physical devices.
Amped User Days 2027: Three Days Of Practical Knowledge, Real-World Workflows, And Expert Exchange
Amped User Days returns for its 7th edition on February 23-25, 2027, as a free online event for Amped software users across European and North American time zones. Sessions cover forensic video analysis, deepfake detection, AI-assisted workflows, speed estimation, and presenting digital evidence in court. A certificate of attendance is available to participants who attend the majority of the event.
MSAB Technology Helps Uncover International Fraud Network And Provides Answers To A Grieving Family
After a woman died by suicide, her family and Dutch investigative TV programme Kees van der Spek Ontmaskert turned to Digital Life Legacy to access her locked tablet. XRY Pro and BruteStorm Surge from MSAB extracted data forensically, revealing she had been systematically targeted by organised internet scammers. The investigation traced the fraudsters to Benin, West Africa, where police arrested three individuals now facing 10 to 15 years in prison.
Research & Techniques
DFRWS Report: Making AI Defensible in Casework
DFRWS has published practitioner perspectives from its 2026 Americas conference on responsible AI use in digital forensics casework, covering performance evaluation, appropriate use, and engineering guardrails. Panelists stressed that AI outputs must be auditable and traceable to source data, treating AI tools with the same scrutiny as conventional forensic tooling. A key finding is that guidance aimed only at practitioners fails to reach investigators and attorneys, making direct examiner engagement with legal stakeholders essential.
Facebook fbclid Parameters Yield Forensic Artifacts
Facebook’s fbclid tracking parameters now encode extractable forensic data including click timestamps, browser identifiers, and source application details. Investigators can parse these values from URLs to reconstruct user activity timelines, with the open-source Unfurl tool updated to support the new format.
Tools & Software
crush-forensics v0.22.0 Adds Major Container Support
crush-forensics v0.22.0 expands evidence container support to include AFF4, Apple disk images, VHD/VHDX/VMDK/QCOW virtual disks (including encrypted), EnCase L01, and FTK Imager AD1 logical evidence formats. Mobile forensics workflows gain UFD/UFDX descriptor-based file system extraction and UFDR reports now surface items derived from files during processing, such as decrypted app databases.
Training & Events
macOS Forensics Course Review Covers WSL Workaround
A detailed review of the Investigating macOS Endpoints course highlights its value for DFIR practitioners, including a practical workaround for taking the course on Windows via WSL rather than a Mac. Core topics span macOS artifact analysis and endpoint investigation methodology.
