Forensic Focus

ElcomSoft’s Vladimir Katalov discusses Apple vs. law enforcement. Gerald Beuchelt talks about deanonymising Tor circuits. DFRWS announce a Women In Forensic Computing workshop day ahead of the main EU conference in March.

Jessica Hyde shares a brief guide to getting started in digital forensics. Haniah Shafi discusses Android Auto and Apple CarPlay forensics. Matthew Seyer releases a tool to help investigators reformat and filter JSONL.

Mark Scanlon discusses his student's research at DFRWS EU 2019. OK, good morning, how are you doing? My name is Mark Scanlon, I’ve been speaking to some of you guys already. I’m from University College Dublin. This work was primarily

Errata Security discuss how to decrypt WhatsApp end-to-end media files. The HTCIA 2020 call for presentations is now open. Linux Security Labs share a review of GRR Rapid Response. Rick Holland recaps the SANS Cyber Threat Intelligence Summit 2020.

Andrea Fortuna shares some thoughts on the Jeff Bezos phone hack data. Ciarán O’Brien provides a triage script to help with retrieving artifacts from compromised Citrix hosts. Magnet discuss how their new AXIOM Cyber tool can help with employee misconduct

Adam Harrison discusses evidence of program execution on different Windows OS versions. Magnet release AXIOM Cyber for remote acquisitions. Foxton Forensics discover some differences between Chromium and Edge Chromium artifacts. Andrew Hoog unpicks NavdDoomConductor, which tracks precise geolocation and time

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss IPv6 to IPv4 conversion in response to a warrant request. Can you explain why this prefetch folder is empty? How would you respond to

Steve Anson’s new book, Applied Incident Response, is now available on Amazon. Ciarán O’Brien has been working on a Jupyter notebook to help automate the process of pulling IOCs from artifacts recovered from compromised Citrix Netscalers. Heather Mahalik instigates a

by Christa Miller Only a few short years ago, the idea of recovering forensic data from the cloud seemed like either troubling overreach, or unnecessarily redundant given the availability of evidence from mobile devices. As encryption became more prevalent on

Ryan Benson shows how Google search URLs can be a great source of digital forensic information. Magnet’s Jamie McQuaid discusses how deduplication can help your forensic analysis. Paraben’s Amber Schroader talks about getting started in digital forensics. Cellebrite share a

Jan Peter van Zandwijk discusses his research at DFRWS EU 2019. Hello, my name is Jen Peter van Zandwijk. I work with the Netherlands Forensic Institute. And in this half-hour I will tell you about some research that they did

DFRWS announce a Women in Forensic Computing Workshop and Digital Forensics Bootcamp as part of this year’s EU conference. Mattia Epifani presents the CASE Ontology to the European Commission in Brussels. Mike Art Rebultan shares his route to a DFIR

by Jade James AccessData Enterprise enables investigators to forensically image and analyse devices. It also provides a means of workflow analysis and documentation, as well as a level of staff management. The inclusion of FTK means that examiners can conduct

Jessica Hyde shares a list of resources to help you keep up-to-date with mobile forensics. 13Cubed talk about CVEs in Windows event logs. Belkasoft discuss what’s new in Belkasoft Evidence Center v9.9.