Forensic Focus

Amped Software demonstrate how to investigate which camera model took a picture using EXIF metadata and JPEG quantization tables. The call for presentations and workshops is open for DFRWS USA 2020. Ed Michael reminds us about the importance of taking

From the 9th to the 11th of March 2020, the Techno Security & Digital Forensics Conference will be running in San Diego, CA. If there are any topics you’d particularly like us to cover, or any speakers you think we

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. With

ElcomSoft’s Vladimir Katalov discusses Apple vs. law enforcement. Gerald Beuchelt talks about deanonymising Tor circuits. DFRWS announce a Women In Forensic Computing workshop day ahead of the main EU conference in March.

Jessica Hyde shares a brief guide to getting started in digital forensics. Haniah Shafi discusses Android Auto and Apple CarPlay forensics. Matthew Seyer releases a tool to help investigators reformat and filter JSONL.

Mark Scanlon discusses his student's research at DFRWS EU 2019. OK, good morning, how are you doing? My name is Mark Scanlon, I’ve been speaking to some of you guys already. I’m from University College Dublin. This work was primarily

Errata Security discuss how to decrypt WhatsApp end-to-end media files. The HTCIA 2020 call for presentations is now open. Linux Security Labs share a review of GRR Rapid Response. Rick Holland recaps the SANS Cyber Threat Intelligence Summit 2020.

Andrea Fortuna shares some thoughts on the Jeff Bezos phone hack data. Ciarán O’Brien provides a triage script to help with retrieving artifacts from compromised Citrix hosts. Magnet discuss how their new AXIOM Cyber tool can help with employee misconduct

Adam Harrison discusses evidence of program execution on different Windows OS versions. Magnet release AXIOM Cyber for remote acquisitions. Foxton Forensics discover some differences between Chromium and Edge Chromium artifacts. Andrew Hoog unpicks NavdDoomConductor, which tracks precise geolocation and time

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss IPv6 to IPv4 conversion in response to a warrant request. Can you explain why this prefetch folder is empty? How would you respond to

Steve Anson’s new book, Applied Incident Response, is now available on Amazon. Ciarán O’Brien has been working on a Jupyter notebook to help automate the process of pulling IOCs from artifacts recovered from compromised Citrix Netscalers. Heather Mahalik instigates a

by Christa Miller Only a few short years ago, the idea of recovering forensic data from the cloud seemed like either troubling overreach, or unnecessarily redundant given the availability of evidence from mobile devices. As encryption became more prevalent on