Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →

Forensic Focus

Forensic Focus Forum Round-Up

Welcome to this round-up of recent posts to the Forensic Focus forums Which tools would you recommend for extracting data from iCloud? Can you help gostep to extract usernames from a FileVault 2 encrypted image? How would you work out

Adding APFS Support to The Sleuthkit Framework

Joe Sylve discusses his work at DFRWS USA 2018. Joe: So, as [Brad said], my name is Joe Sylve, I’m the Director of Research & Development at BlackBag Technologies. I’m going to talk about some work that we’ve done to

Adding APFS Support to The Sleuthkit Framework

Joe Sylve discusses his work at DFRWS USA 2018. Joe: So, as [Brad said], my name is Joe Sylve, I’m the Director of Research & Development at BlackBag Technologies. I’m going to talk about some work that we’ve done to

Child Abuse Images Hidden In Crypto-Currency Blockchain

Images of child sexual abuse have been found embedded in the system powering a high-profile crypto-currency. Somebody added the illegal images to the core ledger of Bitcoin Satoshi Vision (BSV) by using a payment processor. This ledger, known as the

Matt McFadden, Director of Training, BlackBag Technologies

Matt, you've recently been appointed Director of Training at BlackBag Technologies. Tell us about your role and what it involves. The role of Director of Training involves working with many of the teams here at BlackBag. Primarily, I have the

Using Santa To Augment Forensic Investigations

Gary: Hi. The title of this talk is ‘He’s Making a List, and We’re Checking it Twice: Santa for Forensic Analysis’. I want to point out that it was very difficult coming up with this title. We had many runner-ups,

Using Santa To Augment Forensic Investigations

James Nettesheim and Gary Brown discuss their work at DFRWS EU 2018. Gary: Hi. The title of this talk is ‘He’s Making a List, and We’re Checking it Twice: Santa for Forensic Analysis’. I want to point out that it

A Forensic Framework To Identify Local Vs Synced Artifacts

Jacques: Thank you. Alright. First of all, I’ll start off by thanking U-City, thanking [An], who’s my prof, who [00:13] be here today, but actually he’s teaching in Sri Lanka, so he wasn’t able to be here. So, this presentation

A Forensic Framework To Identify Local Vs Synced Artifacts

Jacques Boucher discusses his work at DFRWS EU 2018. Jacques: Thank you. Alright. First of all, I’ll start off by thanking U-City, thanking [An], who’s my prof, who [00:13] be here today, but actually he’s teaching in Sri Lanka, so

Forensic Examination Of Manipulated Email In Gmail

by Arman Gungor Last week, I came across an interesting post on Forensic Focus. The poster, jahearne, was asking about how one can detect manipulation of an existing email in Gmail. In his hypothetical scenario, the bad actor was using

Forensic Examination Of Manipulated Email In Gmail

by Arman Gungor Last week, I came across an interesting post on Forensic Focus. The poster, jahearne, was asking about how one can detect manipulation of an existing email in Gmail. In his hypothetical scenario, the bad actor was using