A round-up of today’s digital forensics news and views:
Forensic Focus News
Forensics Forward 2026 (Online, November 10): A Global Day Of Digital Forensics, Cybersecurity And Law
Forensics Forward: Cybersecurity, Digital Evidence, and Justice runs online on November 10, 2026, co-hosted by Robert B. Fried and Duquesne University’s Cyril H. Wecht Institute of Forensic Science and Law. Seven keynote sessions cover SQLite WAL file recovery, vehicle forensics, AI-assisted legal review, cryptocurrency tracing, and a Silk Road case retrospective, with speakers from the US, UK, and Nigeria. Registration is $180 for professionals and $25 for students.
CCTV Review Under Pressure: How S21 CCTV Helps Investigators Find What Matters Faster
Semantics 21’s S21 CCTV solution applies offline AI engines to help law enforcement rapidly identify subjects across large volumes of video footage, including Ring doorbell, dash cam, and traditional CCTV sources. Built on the same AI core as VisionX, it offers a frontline mode and a pro mode to match different investigator skill levels and comply with emerging police AI standards. The tool has been adopted by law enforcement agencies and commercial operators alike, with one UK force locating a murder suspect across three videos after existing tools had failed to surface the match.
Forensics Europe Expo 2027 Returns To Excel London With Expanded Opportunities For Forensic Professionals
Forensics Europe Expo returns to Excel London on 22–23 June 2027, uniting digital forensics professionals, crime scene investigators, and laboratory scientists for two days of conference sessions and exhibition. For the first time, FEE joins Public Protection Week alongside Counter Terror Expo, The Blue Light Show, and Prison Expo, with a single badge granting access to all four events.
Tools & Software
iLEAPP and LEAPP Suite Gain Major Artifact Updates
The LEAPP suite of open-source forensic tools has released new versions across iOS, Android, Windows, macOS, and vehicle platforms, adding SQLite write-ahead log parsing that surfaces previously committed rows from apps like Snapchat, Discord, and Telegram without implying user deletion. DLEAPP now extracts Windows DPAPI secrets including Wi-Fi keys, LSA secrets, and Chromium credentials via dpapiprobe, while ALEAPP adds Health Connect, Samsung Smart Switch, and per-call SIM data. GLEAPP improves Project VIC import speed and near-duplicate image matching, and RLEAPP adds nine Grok law enforcement return artifacts.
STViewer Brings Open-Source PST/OST Forensic Search
STViewer, a new open-source tool written in Rust, lets investigators browse, search, and export email archives including Outlook PST/OST files, mbox, Gmail Takeout exports, and Apple Mail stores across Windows, macOS, and Linux. It supports full-text search across message bodies and attachments, conversation threading via Message-ID headers, and export to EML, HTML, CSV, and iCalendar formats.
Legal & Policy
UK Admits 20,000-Device Digital Forensics Backlog
The UK Home Office has acknowledged that digital forensic backlogs represent a significant challenge, with an estimated 20,000 devices awaiting analysis at any given time across police units. Ministers admitted the department holds no data on average processing times or how many criminal cases are delayed. A new National Police Service is being established, with a dedicated director of forensic services appointed to centralise digital forensics operations and address capacity pressures.
Read more (publictechnology.net)
Research & Techniques
iOS Forensic Toolkit Log Files Explained
Elcomsoft’s iOS Forensic Toolkit writes three distinct log file types during acquisition, stored under the user profile at Elcomsoft/EIFT/logs on Windows, macOS, and Linux. The main toolkit log, agent installation log, and on-device agent log each capture different failure points, from sideloading errors to bootloader exploit failures. Examiners troubleshooting failed extractions should archive all three file types from the relevant session and submit them rather than screenshots or console pastes.
Read more (blog.elcomsoft.com)
Five-Phase Forensic Workflow for BEC Investigations
Business email compromise investigations demand more than identifying a fraudulent message, requiring examiners to determine whether an account was spoofed or fully compromised. Jeff Rutherford outlines a five-phase forensic workflow covering evidence collection, containment scoping, remediation, and recovery steps. Digital evidence drives each phase, helping investigators establish attacker access and restore environment trust.
Read more (magnetforensics.com)
Linux Shell Binary Data Tricks for DFIR
Handling binary data in the Linux shell is a common challenge when building or scripting DFIR tools. Practical shell techniques for parsing and manipulating raw binary content can sharpen forensic workflows and reduce reliance on third-party utilities.
Industry News
Checklist: Validating AI Tool Outputs in DFIR
Forensic examiners face growing pressure to evaluate AI-driven features flooding the digital investigation toolset, with hallucinated summaries and auto-generated tags posing real evidentiary risks. A practical checklist guides examiners on enforcing chain-of-custody standards and independently validating automated outputs against underlying SQLite databases or hex streams before including them in reports.
