A round-up of today’s digital forensics news and views:
Forensic Focus News
Page One’s Rob Fried And Andrew Milauskas On Using AI In Digital Forensics And E-Discovery
Rob Fried and Andrew Milauskas of Page One, both with 20-plus years in e-discovery and digital forensics, discuss how AI is reshaping investigative workflows. Fried built forensics.expert, a free AI-powered portal trained on his books and lectures, giving practitioners 24/7 access to forensic knowledge without hallucinations beyond his own content. Milauskas, an AI Visionary-certified Relativity Master, adds perspective on deploying AI tools within legal review platforms for law firms and corporations.
Tools & Software
New Open-Source Tool Reads Windows Registry Hives Offline
A new open-source tool called regfprobe reads Windows registry hives offline and read-only, supporting SYSTEM, SOFTWARE, SAM, NTUSER.DAT, Amcache.hve and others directly from E01 or raw disk images without prior extraction. Dirty hives are handled by replaying transaction logs in memory, with a trust indicator displayed to the examiner. Cross-platform executables and a single-file Python option are available under the MIT licence, and upcoming DLEAPP releases will use regfprobe as their registry parsing backend.
Research & Techniques
Hexordia Adds iOS Sysdiagnose Parsers to iLEAPP
Hexordia has contributed new parsers for iOS Sysdiagnose and Unified Logs to iLEAPP, expanding the open-source tool’s artifact coverage for mobile forensic examiners. Developed after extensive research into these log sources, the parsers are now available in the latest iLEAPP release at leapps.org.
Why DFIR Metrics Should Be Derived, Not Collected
Manual metric collection in DFIR operations wastes responder time and degrades investigation quality, mirroring the classic Goodhart’s Law problem. Former Google incident response lead Matt Linton argues that most DFIR metrics should be derived from existing data rather than manually recorded, drawing on a 67-field case-tracking disaster as a cautionary example. Effective metrics act as a translation layer between operational reality and leadership decision-making on headcount and resources.
Read more (osdfir.blogspot.com)
Training & Events
Free Mobile Device Preservation Course Launches
A free short-form course on mobile device preservation covers seizure procedures, consent, warrants, Faraday isolation, device state management, and chain of custody documentation. These foundational steps directly affect evidence admissibility and are critical for DFIR practitioners handling mobile evidence.
Read more (learn.hexordia.com)
Spyder Forensics Adds Drone, Database, AI Workshops
Spyder Forensics has launched three new one-day workshops covering drone and UxS forensic updates, advanced database analysis, and AI artifact examination. The database workshop addresses SQLite WAL, Realm, and Chromium IndexedDB forensics, with emphasis on physical-level recovery and validation beyond automated tools. The AI workshop targets forensic artifacts from ChatGPT, Claude, and Grok, including prompts, cached content, and generated media.
