Forensic Focus Forums - Recent Posts

DFIR Backlogs, Burnout And Cognitive Fatigue: The Silent Operational Risk

Zoe — Thu, 09 Apr 2026 12:07:57 +0000

Backlogs in digital forensics are not just operational bottlenecks—they are a silent psychological risk that can erode decision-making, quality, retention, and ultimately the sustainability of forensic capability.

Read the full article here: https://www.forensicfocus.com/articles/dfir-backlogs-burnout-and-cognitive-fatigue-the-silent-operational-risk/

Webinar: Making The Case For Triage: Transforming Your Digital Forensics For Smarter Investigations

Zoe — Tue, 07 Apr 2026 10:13:11 +0000

Richard Frawley, Director of Training at ADF Solutions, makes the case for triage in digital forensic investigations.

Watch the full webinar here: https://www.forensicfocus.com/webinars/making-the-case-for-triage-transforming-your-digital-forensics-for-smarter-investigations/

Webinar: Mastering Triage: Intro To ADF Pro

Zoe — Mon, 30 Mar 2026 12:19:51 +0000

Join Rich Frawley, a Digital Forensic Specialist and seasoned law enforcement veteran, to explore the powerful capabilities of ADF Pro, designed for investigators and lab examiners.

Watch the full webinar here: https://www.forensicfocus.com/webinars/mastering-triage-intro-to-adf-pro/

ex. cellebrite dongle

xaries — Sun, 29 Mar 2026 15:40:22 +0000

ı need a ex cellebrite dongle. ıf you want to sale your dongle please write o message

Beyond Keywords: AI Classification For Forensic Email Review

Zoe — Tue, 24 Mar 2026 11:55:07 +0000

When keyword searches hit their limits, Aid4Mail shows how AI-powered email classification can surface meaningful evidence across multilingual, high-volume datasets with far greater speed and context.

Read the full article here: https://www.forensicfocus.com/articles/beyond-keywords-ai-classification-for-forensic-email-review/

Podcast: Rob Fried On New Challenges In Digital Forensics

Zoe — Thu, 19 Mar 2026 16:00:02 +0000

Rob Fried joins the Forensic Focus Podcast to talk about the evolving challenges of forensic practice, AI in investigations, and his latest book.

Watch the full episode here: https://www.forensicfocus.com/podcast/rob-fried-on-new-challenges-in-digital-forensics/

Interview: JeongKyun Park, Information Security Student And Independent Developer, Korea Cyber University

Zoe — Tue, 17 Mar 2026 13:26:39 +0000

From Navy CERT to building ICE-Forensic, JeongKyun Park shares how a passion for uncovering the truth through system traces is driving his transition into digital forensics and incident response.

Read the full interview here: https://www.forensicfocus.com/interviews/jeongkyun-park-information-security-student-and-independent-developer-korea-cyber-university/

Question about keeping manifests/logs tamper-evident

Machariel — Mon, 16 Mar 2026 11:55:05 +0000

Hi all,

I’m a developer with an interest in digital evidence integrity. It bothers me that logs, manifests, or artifact inventories can potentially be altered before they ever reach court.

I’ve developed a working CLI tool that currently implements things like:

hashing collected items
signing manifests (when a key is available)
internally chained log entries
verification of manifests and logs afterwards

The idea is to record interesting file states as early as possible so there’s a stronger trail showing that artifacts and items of interest remained unchanged later on. I can't imagine I'm done feature-wise. This is where your feedback comes in.

What I’m curious about is the practical side from people who actually investigate cases or even take decisions in a final stage, whether it's a judge, committee, prosecutor deciding for a go/no-go and so forth.

For example:

How often do you run into concerns about digital evidence, log, or manifest tampering?
Are integrity protections (hashes, signatures, chained logs) something investigators rely on, or would rely on if certain conditions are met?
What tends to matter most when these artifacts end up being reviewed by courts, lawyers, or oversight bodies?
When accusations of digital tampering arise (or need to arise), what actually helps to prove or disprove them?

I’m mainly trying to understand what investigators and legal reviewers actually need here rather than guessing from the engineering side.

Thanks for any insight.

RE: Forensic Inquiry: File Deletion, Recovery, and Metadata Behavior

Machariel — Sun, 15 Mar 2026 22:43:55 +0000

Goodday sir, madam,

Not a forensic expert, but software programmer in the process of getting to know the forensic world. Currently in the process of building a chain-of-custody and audit system.

1. No. It's not proof. In short: a/the system could have done or some sub-system, usually due to a some automatic cleaning or pruning process. From my experience as a coder, correlative artifact analysis is a must. I programmed this myself only days ago.

2. No, not through "normal" means. Deep technical understanding and relevant programming skill would be needed to make it happen. The point is that one has to have direct access to the disk. The next question could be: is it possible to send/share files whilst bypassing the regular filesystem? If so, then it would never be possible to prove a file was sent. The answer is probably not - you have to ask forensic tool users who are known to access disks directly. However, highly advanced custom-built software trickery could accomplish that. In theory, it's possible. Likely? No. Depends on what's going on.

3. Yes.
I had to look it up in:
https://developer.android.com/reference/android/provider/MediaStore
So for Android, a clear "yes".

Goes also for iOS:
https://theforensicscooter.com/2022/05/02/photos-sqlite-query-documentation-notable-artifacts

4. Yes, with exceptions. Subsequent deletion alters file system timestamps (Creation, Modification) but generally does not alter embedded EXIF/XMP data within the image binary itself. At filesystem/library level data will be altered (assuming "normal" usage again). It's still not the hardest possible proof - which is in my world logic, if you will. So once again correlative analysis is required since the altered filesystem, library, EXIF and application activity logs are independent sources.

Again, this is through the eyes of a programmer.

RE: Word Document Meta Data Changed

Machariel — Sun, 15 Mar 2026 21:26:38 +0000

Goodday sir, madam,

I'm not a forensic investigator but a programmer in the process of learning about the forensic world - hence my presence on this forum. Please verify the format of your word document. If it is a docx then:

Check inside the .docx container (.docx is a ZIP archive) and search for files like:

docProps/core.xml
docProps/app.xml
word/document.xml

which may contain timestamps such as:

dcterms:created
dcterms:modified
editing time or revision numbers

If the metadata was manually altered through Word, inconsistencies between these fields may appear.

If you have access to the system(s) where creation and modification happened then you will have additional options, but that's perhaps for later. Let's try this first. I'll be watching this thread in case you need help.

Edit: if the document was transferred to you or anywhere before you had it in your possession then store the transfer date-times. Basically you want to keep as much as possible data in case things disappear.