A round-up of today’s digital forensics news and views:
Legal & Policy
Europol Maps EU Digital Forensics Capability Gaps
The European Commission and Europol have published a gap and needs analysis identifying critical shortfalls in digital forensic capabilities across EU member states. Key problem areas include cloud, IoT, and vehicle forensics, unaffordable commercial tools, and insufficient cross-border expertise sharing. Findings will shape future EU funding under the Internal Security Fund and guide development of shared forensic solutions.
Courtroom Prep Guide for Digital Examiners
Effective testimony requires examiners and attorneys to align on what the data proves before trial, not during it. A practical framework covers digital evidence authentication, user attribution, courtroom exhibits, and preparation for both direct and cross-examination.
Read more (magnetforensics.com)
Research & Techniques
macOS Unified Log Reveals Touch ID vs Password Unlocks
On macOS, the loginwindow unified log entry ‘password is CORRECT’ appears on Touch ID unlocks as well as password unlocks, meaning the entry alone cannot confirm which authentication method was used. Examiners must correlate it with adjacent biometrickitd MATCH events and keybag transitions to inBioUnlock state to distinguish the two. Additionally, the keybag reaches ‘locked’ state roughly 10 seconds after screen lock, and the kernel ‘is now UN-locked’ line does not appear on every unlock, so its absence is not evidence that no unlock occurred.
Industry News
DFIR Experts Debate AI Validation and Court Use
At the SANS DFIR Summit 2026, a panel of senior examiners warned that AI tools will hallucinate and that most practitioners already fail to validate the tools they use, making AI adoption riskier. Mari DeGrazia’s intern model, where AI flags candidates and a validated deterministic tool does the actual conversion, offers a practical workflow framework. Ovie Carroll stressed that courtroom testimony must center on the artifact, not the AI output, citing the still-pending Federal Rule of Evidence 707 and Daubert reliability concerns.
Read more (smarterforensics.com)
Forensic Focus Opens State of DFIR Survey
Forensic Focus has launched its State of DFIR Survey, seeking input from digital forensics and incident response practitioners on caseloads, tool usage, AI in evidence, skills shortages, and career retention. The anonymous survey takes around eight minutes to complete, and participants receive early access to the full report ahead of its January publication.
Case Studies
Citizen Lab Confirms Pegasus Infection in Serbia
Citizen Lab confirmed Pegasus spyware infected the iPhone of University of Belgrade rector Vladan Đokić via a zero-click exploit, with forensic artifacts analyzed at his request alongside Serbian digital-rights group SHARE Foundation. A second case involves a senior prosecutor who received Apple Threat Notifications in August, with forensic analysis still ongoing. Earlier Serbian cases linked NoviSpy Android spyware to Serbia’s BIA security service, installed on activists’ phones after Cellebrite unlocking during police questioning.
Tools & Software
LAVA Viewer Brings Native LEAPPS Artifact Visualization
LAVA is an open-source viewer designed to natively render LEAPPS output, eliminating the need for a compatible browser or office software to parse formatted HTML and table-based reports. LEAPPS, a frequently updated FOSS forensic framework, generates artifact reports that LAVA surfaces directly, streamlining mobile and computer forensic workflows.
Read more (matthewplascencia.substack.com)
Training & Events
Workshop Wednesday: SQLite Forensics Practical Queries
SQLite databases appear across mobile, desktop, and application forensics, making them a routine artifact in DFIR examinations. This Workshop Wednesday session covers database structure, common forensic locations, and practical SQL queries for parsing data into human-readable output.
