A round-up of today’s digital forensics news and views:
Tools & Software
Eric Zimmerman Tools Move to .NET 10
Eric Zimmerman’s forensic toolkit has released its October 2026 update, migrating all tools to .NET 10 LTS from .NET 9, with AmcacheParser, VSCMount, and WxTCmd among those updated. The suite covers registry analysis, MFT parsing, jump lists, shellbags, event logs, and dozens of other Windows artifact categories relied on daily by examiners.
Read more (ericzimmerman.github.io)
Six LEAPP Tools Ship Major Feature Release
Six LEAPP tools shipped simultaneously, adding SHA-256 hashing for staged files, LVM2, LUKS, RAID, and FAT12/16 raw image support, and dozens of new artifacts across iOS, Android, Windows, vehicle, and desktop platforms. iLEAPP gains sysdiagnose unified log artifacts and Life360 data; DLEAPP adds Windows event log artifacts including Sysmon, BitLocker, RDP, and Active Directory extraction from ntds.dit. All tools remain free and open source, with Windows builds now distributed as portable executables.
Hardware Breakpoint Captures Windows Hello PIN
A new open-source project, WHFB-PinCapture, captures Windows Hello for Business PINs at entry by placing a CPU hardware breakpoint on NgcSerializeConvenienceCredential inside LogonUI.exe, reading the PIN from thread context via a Vectored Exception Handler without modifying any code. This approach bypasses VBS/VSM and TPM protections that make offline PIN recovery impossible, providing a reliable capture-at-entry method for environments where the examiner has elevated administrator access. A companion PowerShell script, Get-WHFBKeys.ps1, enumerates WHFB, NGC, and TPM key material and outputs a JSON report.
EvidenceForge Studio GUI Launches for MacOS
Cisco Talos has released EvidenceForge Studio v2.2.0a1, an alpha GUI for MacOS that bundles eforge, Python, and all required dependencies into a standalone app. Examiners no longer need to manually check out the repository to get started, reducing setup friction for forensic workflows. Linux and Windows support is planned for future releases.
Instagram Assisted Capture Tool Automates OSINT Collection
A new Instagram Assisted Capture feature is coming to the Forensic OSINT browser extension, automating the process of opening posts, expanding comment threads, and cycling through carousels across a user-defined date range. SHA-256 hashing on every captured file and comment-count verification against Instagram’s reported figures add forensic integrity to the workflow. Practitioners retain control, confirming each capture individually with the option to pause or stop at any point.
Research & Techniques
iOS Unified Log Sets Corroborate Unlock Events
On iOS 18.2.1, a Face ID unlock leaves three Unified Log entries from three separate processes within 33 milliseconds, each recording a distinct step in the biometric chain. Corroborating hits across processes, rather than relying on any single search term, is what supports a forensic conclusion about unlock method. Each search term set also documents what it cannot show, preventing over-reading of individual log lines.
Windows LSA Secrets Decryption Chain Explained
Windows hides its LSA secrets across multiple encrypted layers rooted in a Boot Key scattered through SYSTEM hive registry class names. A full re-implementation of the decryption stack covers Boot Key permutation, SHA-256 iterated key derivation, AES-256-ECB unwrapping of PolEKList, and DCC2 cached domain credential extraction. Every step includes working C code against the CryptoAPI.
Android Battery File Yields Ten Days of App History
Android’s batterystats-daily.xml stores up to ten days of battery discharge and charge steps alongside package install and update records, offering examiners a corroborating timeline artifact across Android 11 to 16. The file encodes battery level, screen state, and app version codes in a compact hex format, with uninstalls recorded as version zero rather than a distinct element. An existing ALEAPP parser covers both plain XML and Android Binary XML variants, though an earlier misreading of the screen-state mode letters has now been corrected.
Read more (bebinary4n6.blogspot.com)
Chromium ETags Prove Downloaded File Identity
When a malicious file is deleted before it can be hashed, the Chromium History database may still hold the server’s ETag and Last-Modified headers, recorded to support download resumption. A strong ETag guarantees byte-for-byte identity, meaning a matching value between the suspect’s browser record and a live server response directly links the two downloads. Examiners can query the downloads table with a simple SQL statement or use Hindsight to surface these validators automatically.
Threat Intelligence
Novel macOS Ransomware Uses Metamorphic Rebuilding
A previously undetected macOS ransomware sample named Heartbreaker uses AES-256-GCM encryption with a hardcoded key, enabling file recovery without paying the ransom. Written in Rust, it attempts persistence and metamorphic self-rebuilding via recompilation, making it unusual among macOS ransomware families. Objective-See’s entropy-based RansomWhere? heuristic successfully detected it without signatures or AI.
Case Studies
PowerShell Artifacts Reveal Attacker Post-Compromise Workflow
Recovered PowerShell scripts from a recent incident exposed multiple attacker post-compromise stages, including a file-based command runner, a credential-harvesting prompt, Active Directory reconnaissance, and SMB share discovery. The credential harvester used Windows PromptForCredential to solicit plaintext passwords, logging every attempt to disk, making any recovered log file an immediate indicator of compromise. Overlapping tradecraft with Microsoft’s documented TerminalFix campaign provides additional attribution context for investigators.
Snapchat Forensics Examined in Live Court Demo
Defense expert Glenn Buckley demonstrated how Snapchat stores photos and videos differently depending on whether files are saved locally or remain server-side, revealing why in-app metadata and device timestamps can diverge. In the State of Tennessee vs. Ahmed Gatlin, Buckley showed how copying or exporting snaps can alter metadata, and why matching the correct device and app version is critical to accurate evidence interpretation.
Industry News
Passware Kit 2026 v4 Adds BitLocker, eCryptfs Support
Passware Kit 2026 v4 expands BitLocker decryption to cover more AMD Zen/Zen+ devices and adds PIN recovery for Lenovo hardware, alongside the new YellowKey method. Decrypted full-disk images can now be saved directly in E01 format, and eCryptfs-encrypted Linux volumes are now supported.
Training & Events
IACIS Scholarship Funds LE Examiner Training
The Will Docken Scholarship covers full tuition, lodging, a laptop, software, and 12 months of Arsenal Recon tools for law enforcement digital forensic examiners at small agencies. Applicants must work for an agency with no more than two personnel conducting digital forensic examinations, and applications are open October 1 through November 30 for 2027 BCFE training in Orlando. Recipients also gain entry into the CFCE certification program.
Brett Shavers Hosts Free Live Investigation Walkthrough
Brett Shavers will walk through his investigative reasoning on a real, ongoing case in a free 30, 45 minute Zoom session on October 28. Unlike CTF or simulated exercises, the session focuses on hypothesis testing, contradiction analysis, and reasoning behind investigative decisions, with live audience questions.
