A round-up of today’s digital forensics news and views:
Forensic Focus News
The Forensic Focus State Of DFIR Survey Is Now Open
The Forensic Focus State of DFIR Survey is now open, covering caseloads, AI use in examinations, tool adoption, skills gaps, and career outlook. Responses are anonymous and results will be published in aggregate as the free State of DFIR Report 2027 in January. The survey closes 30 November 2026, takes around eight minutes, and participants can enter a draw for one of five US$100 prepaid e-gift cards.
Magnet Autokey: Accelerating Your Vehicle Investigations
Modern vehicles store rich digital evidence including GPS location data, door and seat events, and records of connected mobile devices, making them valuable investigation sources alongside phones and computers. Magnet Autokey is designed to extract and analyse this infotainment system data, helping investigators corroborate or challenge witness and suspect accounts. Connected device logs are especially significant, as suspects and thieves routinely pair personal phones to unfamiliar vehicles.
Research & Techniques
New Research Targets OneDrive Forensic Artifacts
Brian Maloney’s research on OneDrive forensic artifacts, presented at the SANS DFIR Summit, covers the evolution of OneDrive and its implications for casework. A companion tool accompanies the findings, giving examiners practical support for cloud storage investigations.
Read more (malwaremaloney.blogspot.com)
Free 720-Page Incident Response Book Available
SANS Faculty Fellow Joshua Wright released Dynamic Incident Response, a 720-page incident response book, free to the community. Wright is distributing signed print copies at the DFIR Summit in Arlington, with the full text available as a free download for those not attending.
Read more (dynamicincidentresponse.com)
Legal & Policy
Deepfake Authentication Requires Device-Level Forensic Exam
A digital forensics expert presented to the Judicial Conference Advisory Committee on Evidence Rules, advising on proposed Rule 901(c) governing deepfake authentication. When a file’s authenticity is disputed, device-level forensic examination of the source device is often the only reliable method to distinguish real from AI-generated content. The committee is also considering proposed Rule 707 on AI-generated evidence.
Tools & Software
Amped FIVE Adds Encrypted CCTV Decryption Tools
Amped FIVE update 42578 adds decryption support for Backup Player recordings and password-protected Hikvision MP4 exports, letting examiners access previously locked CCTV evidence directly within the tool. A new Atom Viewer enables forensic inspection of MP4 container structures, helping identify missing MOOV atoms or proprietary files masquerading as standard MP4s.
Read more (blog.ampedsoftware.com)
qnxprobe Supports Wide Embedded Filesystem Analysis
qnxprobe identifies and parses filesystems common in automotive head units, drones, routers, and cameras, including QNX4/6, UBIFS, YAFFS, APFS, and F2FS, using native volume structures rather than partition type bytes. Volumes can be browsed, reported, or extracted to a ZIP archive without mounting or writing to the source image.
Case Studies
Memory Forensics Exposes VPN Appliance Attack Chain
When attackers tamper with logs and evade integrity checks on edge devices, memory forensics becomes a critical investigative tool. Volexity used memory analysis to reconstruct both the exploit chain and post-access attacker activity on a VPN appliance, recovering evidence that traditional log review would have missed.
Industry News
Candiru Spyware Delivered Via Ad Networks
Citizen Lab researchers confirmed mercenary spyware from Candiru reached Al Jazeera devices through targeted online ads that required no user interaction, executing attack code the moment an ad loaded. At least 45 devices were targeted in 2024, 2025, with traffic logs revealing a consistent connection sequence: Discover-Tech ad server, Candiru screening server, then command-and-control. Defenders can hunt for this sequence in network logs using published IOCs, including a SHA-256 hash of the recovered spyware sample and associated domains.
