A round-up of today’s digital forensics news and views:
Forensic Focus News
How Detego Global’s AI Technology Is Transforming Child Abuse Investigations
Detego Global’s Unified Digital Forensics Platform applies AI to child abuse investigations, offering indecent image detection, semantic search, face recognition, and real-time transcription to accelerate evidence processing. Integrations with Project VIC and CAID allow investigators to flag millions of known abuse images in seconds, while selective blurring and safer viewing controls reduce exposure to harmful content. Full audit trails and offline AI capabilities keep sensitive data within secure, legally defensible workflows.
AI For Investigations: 5 Myths, Debunked
AI tools like Cellebrite Genesis augment investigators rather than replace them, with every finding traceable back to its source evidence. Real deployments across law enforcement and private-sector firms show significant time savings, including a case where 16 previously unidentified victims were surfaced in 15 minutes instead of two weeks. Human-in-the-loop oversight and chain-of-custody discipline remain central to defensible, court-ready results.
Tools & Software
MalChela v4.5 Adds Native Windows Support
MalChela v4.5 now runs natively on Windows, eliminating the WSL requirement and offering the same CLI and web interface available on macOS and Linux. The release completes a full migration from YARA to yara-x, VirusTotal’s Rust-based rewrite, removing the need for system-level YARA libraries on any platform. TIQuery gains a ScanMalware URL source and opt-in controls for third-party submissions, plus sample fallback downloads from Triage alongside MalwareBazaar.
Read more (bakerstreetforensics.com)
Stark4n6 StartMe Adds New DFIR Tools
Kevin Pagano’s November 2026 Forensics StartMe update adds several community resources, including Dumplyzer, an open-source memory forensics platform for DFIR and malware analysis, and GLEAPP, an image and video forensic triage toolkit. A new CCTV Log Analyzer supports extraction of system logs from Hikvision, Dahua, and TVT DVR/NVR disk images, expanding options for practitioners working multimedia evidence.
Research & Techniques
Unfurl Decodes Hidden Facebook Click Identifiers
Facebook and Instagram fbclid parameters now encode click timestamps, source app identifiers, and browser IDs within their values. Unfurl can automatically decode these parameters, surfacing investigative artifacts from URLs that previously appeared opaque.
Training & Events
13Cubed Updates Windows Endpoint Forensics Course
13Cubed has expanded its Investigating Windows Endpoints course with rebuilt modules covering the Registry, NTFS anatomy, LNK files, and file deletion and recovery. New content includes RDP bitmap cache forensics, AmCache SQLite database analysis, Prefetch in alternate data streams, and Windows Search Index historical data recovery. MFTECmd/mactime timeline walkthroughs and historical path reconstruction resources round out the update.
Read more (training.13cubed.com)
Industry News
DFIR Interview Prep Series Launches with Hexordia
A five-part video series targets digital forensics and incident response job candidates, walking through common interview questions at three experience levels. Jessica Hyde of Hexordia analyzes candidate responses, with the first question addressing how examiners maintain digital evidence admissibility in court.
