Forensic Focus

Jack Farley discusses forensic analysis of OpenVPN on iOS. Brett Shavers writes about the easy way to learn DFIR. The Eclectic Light Company has updated Nalaprop to parse natural language. Digital Forensics Magazine share news of a new UK initiative

Thanks to TV series and movies, people nowadays believe that when it comes to digital images and videos, everything is possible. Some of you may remember the “never-ending enhance” sequence in Blade Runner or the magic zoom they have in

Sharon D. Nelson shares her thoughts on Craig Ball's recent article about the war on ediscovery. Passware explain Bitlocker decryption. Another arrest has been made in the Darkode case. OpenText share five things they've learned since GDPR came into being.

Sarah Edwards shares her presentation ‘Watching the Watchers‘ from Objective by the Sea. Ariel Watson discusses what blockchain means for digital evidence sharing. Bryan Ambrose demonstrates how to restore Windows sticky notes from volume shadow copies. The Digital Investigations Conference

by Hans Henseler UK Law Enforcement agencies are facing significant challenges related to digital evidence disclosure in criminal prosecution cases. Suspects who are charged with a crime must have access to all relevant evidence to ensure a fair trial, even

Chris Dale interviews Julia Helmer of Consilio about mobile data. A new fingerprinting technique developed by researchers at the University of Cambridge allows websites to uniquely identify phones based on data from the accelerometer, gyroscope, and magnetometer sensors. John Patzakis

Amped posted a blog about how to deal with interlaced videos in Amped FIVE. Alexis Brignoni demonstrates how to find Badoo chats in Android using SQL queries and the MAGNET App Simulator. Hexacorn plays with delay-loaded DLLs. Harlan Carvey talks

Techno Security MB is under way – keep up to date on Twitter. Binary Hick gives us an in-depth look at Snapchat on Android. Ali Hadi looks at Windows InstallTime vs InstallDate registry values. Foursquare has acquired Placed, meaning it

BlackBag Tech have announced that MacQuisition can now produce decrypted physical images of Apple’s latest systems using the T2 chip. Find Ashley Hernandez’s demonstration here. Didier Stevens has updated hex-to-bin.py to Version 0.0.2, which comes with an option to parse

Tell us a bit about your role: what does a day in your life look like? I am Kim Hyun-soo, a founder of HancomGMD. Over the years, my daily routine has been very focused on the sole purpose of making

Hexacorn suggests that the Run key in the Windows registry could be interesting for forensic investigators to look at. Harlan Carvey wrote a post discussing troubleshooting and deep knowledge, or what to do when a tool that we’re using doesn’t

by Christa Miller, Forensic Focus Malware aimed at industrial control systems (ICS) is nothing new. Nearly 10 years have passed since Stuxnet first targeted the supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs) associated with centrifuges