Forensic Focus Forums - Recent Topics

Video Timing In Amped FIVE

Zoe — Thu, 04 Jun 2026 09:19:27 +0000

Video timing can make or break forensic interpretation — Amped Software explains how Amped FIVE helps analysts evaluate timing sources, verify reliability, and preserve authenticity in video evidence.

Read the full article here: https://www.forensicfocus.com/articles/video-timing-in-amped-five/

Interview: Andreas Antonsen, Founder, STNDRDS AB

Zoe — Wed, 03 Jun 2026 09:56:11 +0000

Andreas Antonsen, founder of STNDRDS AB, explains why S-EVA is built around source-cited lexicons, offline analysis, and evidence-grade outputs investigators can defend in court.

Read the full interview here: https://www.forensicfocus.com/interviews/andreas-antonsen-founder-stndrds-ab/

Interview: Andreas Antonsen, Founder, STNDRDS AB

Zoe — Wed, 03 Jun 2026 09:55:14 +0000

Andreas Antonsen, founder of STNDRDS AB, explains why S-EVA is built around source-cited lexicons, offline analysis, and evidence-grade outputs investigators can defend in court.

Read the full interview here: https://www.forensicfocus.com/interviews/andreas-antonsen-founder-stndrds-ab/

Podcast: Burnout, PTSD, Suicidal Thoughts – The DFIR Well-Being Study Results Are In

Zoe — Tue, 02 Jun 2026 10:37:30 +0000

Phil Anderson joins Paul Gullon-Scott to unpack the Forensic Focus International Well-Being Study, exploring what the findings reveal about AI-generated CSAM, burnout, PTSD symptoms, and the urgent need for better support across the DFIR profession.

Watch the full podcast here: https://www.forensicfocus.com/podcast/burnout-ptsd-suicidal-thoughts-the-dfir-well-being-study-results-are-in/

Podcast: Burnout, PTSD, Suicidal Thoughts – The DFIR Well-Being Study Results Are In

Zoe — Tue, 02 Jun 2026 10:36:39 +0000

Watch the full podcast here: https://www.forensicfocus.com/podcast/burnout-ptsd-suicidal-thoughts-the-dfir-well-being-study-results-are-in/

I built an affordable forensics platform for solo consultants — looking for feedback from people who actually do this work

crownwell labs — Sat, 30 May 2026 19:16:23 +0000

Hi all — I want to be upfront: I built this tool and I'm sharing it here
because this community is exactly the audience I built it for. Not a sales
pitch — genuine request for feedback.

I kept seeing the same problem: solo DFIR consultants and small IR teams
either paying $3,000+/year for enterprise tools (EnCase, Magnet AXIOM, X-Ways)
or cobbling together free tools that aren't court-ready. There's a gap in the
middle that nobody has really filled.

Cyfirx is my attempt at that middle ground.

What does Cyfirx do

- Evidence acquisition and cataloguing with automatic MD5/SHA hash
verification
- Full chain-of-custody log — every action on every evidence item is
timestamped, recorded, and tamper-evident
- Court-ready report generation — structured output built around evidentiary
requirements
- Case management — run multiple investigations in parallel without mixing
evidence
- Completely offline — no cloud dependency, no data leaves the machine

whether it's worth anything.

1. For those of you doing solo or small-team forensics work: what's your
current tooling setup and what's the biggest gap in it?
2. Is court-ready chain-of-custody reporting something you actually need to
produce, or does it vary by jurisdiction/case type?
3. Is offline-first a feature that matters to you in practice?
4. What would make you switch away from whatever you're using now?

I'm early enough that honest criticism is far more useful than kind words. If
there's something obvious I've missed or got wrong, please say so.

Link: cyfirx.com
Thanks — Warner Lowe

Webinar: From Seizure To Investigation In Minutes: What’s New In ADF Pro v6.3

Zoe — Thu, 28 May 2026 10:15:26 +0000

Rich Frawley, Digital Forensic Specialist and law enforcement veteran, explores the game-changing features of ADF Tools – MDI and ADF Pro – Version 6.3.0!

Watch the full webinar here: https://www.forensicfocus.com/webinars/from-seizure-to-investigation-in-minutes-whats-new-in-adf-pro-v6-3/

software donation

jaysouth — Wed, 27 May 2026 19:13:43 +0000

I have a Sanderson sqlite forensic toolkit dongle, and the accompanying book ($600 cost) and Elcomsoft iOS Forensic Toolkit Version Version 8 dongle ($2000+) that I purchased a little over two years ago, I would like to donate if anyone is interested in playing around with these tools. Figured a student may not have access to these, and there isn't much of a secondary market for these. Whoever has the dongle basically holds the license, as the usb must be inserted and remain in place to run either of these pieces of software.

The Elcomsoft is a bit out of date now, it can't deal with the latest and greatest versions of iOS, but it covers quite a few devices and iOS versions nonetheless. And you can at least see how it works. Below is from the manual re what it can process.

I'd just ask for the cost of shipping, depending on where it's going. Sorry if this isn't the right place to put this. I hate for these to go to waste when they were so expensive. I'm a hobbyist now, used ot work in cybersecurity way back when, and just like to keep abreast of what's out there, thought someone else might want to do the same. Feel free to message me at jsouthto@gmail.com thanks!

A.1.1.1 Method 1
The following devices can be put into DFU mode with Method 1 as described in Section 4.1.1.1.

• iPod touch 6th gen: A1574
• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349
• iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
• iPhone 5S (iPhone6,1/iPhone6,2): A1453, A1533, A1457, A1518, A1528, A1530 • iPhone 6 (iPhone7,2): A1549, A1586, A1589
• iPhone 6 Plus (iPhone7,1): A1522, A1524, A1593
• iPhone 6s (iPhone8,1): A1633, A1688, A1691, A1700
• iPhone 6s Plus (iPhone8,2): A1634, A1687, A1690, A1699
• iPhone SE (iPhone8,4): A1662, A1723, A1724

A.1.1.2 Method 2

The following devices can be put into DFU mode with Method 2 as described in Section 4.1.1.2. • iPhone 7 (iPhone9,1/iPhone9,3): A1660, A1778, A1779, A1780, A1853, A1866
• iPhone 7 Plus (iPhone9,2/iPhone9,4): A1661, A1784, A1785, A1786

A.1.1.3 Method 3

The following devices can be put into DFU mode with Method 3 as described in Section 4.1.1.3. • iPhone 8 (iPhone10,1/iPhone10,4): A1863, A1905, A1906, A1907
• iPhone 8 Plus (iPhone10,2/iPhone10,5): A1864, A1897, A1898, A1899
• iPhone X (iPhone10,3/iPhone10,6): A1865, A1901, A1902, A1903

A.1.1.4 Method 4

The following devices can be put into DFU mode with Method 4 as described in Section 4.1.1.4. • AppleTV 3 (AppleTV3,2): A1469

A.1.2 Physical acquisition

Physical extraction currently supports iOS 8.0 - iOS 16.0 for the following devices:

A.1.2.1 iPhone

• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349
• iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516
• iPhone 5S (iPhone6,1/iPhone6,2): A1453, A1533, A1457, A1518, A1528, A1530 • iPhone 6 (iPhone7,2): A1549, A1586, A1589

• iPhone 6 Plus (iPhone7,1): A1522, A1524, A1593
• iPhone 6s (iPhone8,1): A1633, A1688, A1691, A1700
• iPhone 6s Plus (iPhone8,2): A1634, A1687, A1690, A1699
• iPhone SE (iPhone8,4): A1662, A1723, A1724
• iPhone 7 (iPhone9,1/iPhone9,3): A1660, A1778, A1779, A1780, A1853, A1866 • iPhone 7 Plus (iPhone9,2/iPhone9,4): A1661, A1784, A1785, A1786
• iPhone 8 (iPhone10,1/iPhone10,4): A1863, A1905, A1906, A1907
• iPhone 8 Plus (iPhone10,2/iPhone10,5): A1864, A1897, A1898, A1899
• iPhone X (iPhone10,3/iPhone10,6): A1865, A1901, A1902, A1903

Note: physical extraction of iPhone 8, iPhone 8 Plus, iPhone X with iOS 14 and higher works only if passcode is not set

A.1.2.2 iPod Touch

• iPod touch 4th gen (iPod4,1): A1367 (not tested) • iPod touch 6th gen (iPod7,1): A1574
• iPod touch 7th gen (iPod9,1): A2178

A.1.2.3 iPad

• iPad (iPad1,1): A1219
• iPad 3G (iPad1,2): A1337
• iPad 4 (iPad3,4/iPad3,5/iPad3,6): A1458, A1459, A1460
• iPad Air (iPad4,1/iPad4,2/iPad4,3): A1474, A1475, A1476
• iPad Mini Retina (iPad4,4/iPad4,5/iPad4,6): A1489, A1490, A1491
• iPad Mini 3 (iPad4,7/iPad4,8/iPad4,9): A1599, A1600, A1601
• iPad Mini 4 (iPad5,1/iPad5,2): A1538, A1550
• iPad Air 2 (iPad5,3/iPad5,4): A1566, A1567
• iPad Pro (iPad6,3/iPad6,4/iPad6,7/iPad6,8): A1673, A1674, A1584, A1652
• iPad 2017 (iPad6,11/iPad6,12): A1822, A1823
• iPad Pro 2 (iPad7,1/iPad7,2,/iPad7,3/iPad7,4): A1670, A1671, A1701, A1709 • iPad 6 (iPad7,5/iPad7,6): A1893, A1954
• iPad 7 (iPad7,11/iPad7,12): A2197, A2200

A.1.2.4 AppleTV

• AppleTV 2 (AppleTV2,1): A1378 (not tested)
• AppleTV 3 (AppleTV3,2): A1469
• AppleTV 4 (AppleTV5,3): A1625
• AppleTV 4K (AppleTV6,2): A1842 (not tested)

A.1.2.5 Apple Watch

• Apple Watch S3 (Watch3,1, Watch3,2, Watch3,3, Watch3,4 ): A1858, A1859, A1860, A1861, A1889, A1890, A1891, A189

A.1.4 Agent-based acquisition

Agent-based acquisition is available for the following devices and iOS versions:

A.1.4.1 iPhone
• iPhone 5s, iPhone 6, iPhone 6s Plus: iOS 9.0 - 12.5.5
• iPhone 6s, iPhone 6S Plus, iPhone SE (1st gen), iPhone 7, iPhone 7 Plus: iOS 9.0 - 14.3 • iPhone 8, iPhone 8 Plus, iPhone X: iOS 11.0 - 15.3.1
• iPhone Xr, Xs, Xs Max: iOS 12.0 - 15.3.1
• iPhone 11, 11 Pro, 11 Pro Max, iPhone SE (2020): iOS 13.0 - 15.3.1
• iPhone 12, iPhone 12 Mini, iPhone 12 Pro, iPhone 12 Pro Max: iOS 13.0 - 15.3.1
• iPhone 13, iPhone 13 Mini, iPhone 13 Pro, iPhone 13 Pro Max: iOS 15.0 - 15.3.1

A.1.4.2 iPad
• iPad Mini 2 and 3, iPad Air (1st gen): iOS 9.0 - 12.5.5
• iPad 5th-7th gen, iPad Pro 1st and 2nd gen: iOS 9.0 - 14.3
• iPad Mini 5, iPad Air 3rd gen, iPad Pro 3rd and 4th gen, iPad 8th gen: iOS 12.0 - 15.3.1 • iPad 9th gen: iOS 13.0 - 15.3.1
• iPad Air 4th gen: iOS 13.0 - 15.3.1
• iPad Pro 5: iOS 14.5 - 15.3.1
• iPad Mini 6: iOS 15.0 - 15.3.1

A.1.4.3 iPod Touch
• iPod Touch 7th gen: iOS 12.0 - 14.3

Please note that for versions 15.2 to 15.3.1 only full file system extraction is possible, but no keychain yet.

A.1.5 Logical acquisition

Logical acquisition is supported for all iOS devices regardless of the installed version.

A.1.6 Passcode cracking

When performing physical acquisition with EIFT, passcode cracking is available for the following devices:

A.1.6.1 iPhone

• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349 • iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516

A.1.7 Disk decryption

When performing physical acquisition with EIFT, offline disk dump decryption is available for the following devices:

A.1.7.1 iPhone

• iPhone 4 (iPhone3,1/iPhone3,2/iPhone3,3): A1332, A1349 • iPhone 5 (iPhone5,1): A1428, A1429, A1428
• iPhone 5c (iPhone5,4): A1507, A1526, A1529, A1516

A.1.8 Hardware checkm8 exploit

Hardware based checkm8 implementation as described in Section 6.6, is currently available for the following devices:

A.1.8.1 iPhone

• iPhone 4s (iPhone4,1): A1387, A1431 A.1.8.2 iPod Touch

• iPod touch 5th gen (iPod5,1): A1421, A1509

A.1.8.3 iPad

• iPad 2 (iPad2,1/iPad2,2/iPad2,3/iPad2,4): A1395, A1396, A1397 • iPad 3G (iPad3,1): A1416
• iPad 3 (iPad3,2/iPad3,3): A1403, A1430
• iPad mini (iPad2,5/iPad2,6/iPad2,7): A1432, A1454, A1455

A.1.8.4 Apple TV

• AppleTV 3 (AppleTV3,1): A1427

When The Job Comes Home: The Impact On Families

Zoe — Thu, 21 May 2026 16:08:35 +0000

Paul Gullon-Scott offers a powerful, deeply personal account of how digital forensic work can cross the threshold into family life, and why investigators and their loved ones need better support.

Read the full article here: https://www.forensicfocus.com/articles/when-the-job-comes-home-the-impact-on-families/

Webinar: Inside The Cellebrite Spring 2026 Release

Zoe — Thu, 21 May 2026 10:46:22 +0000

Cellebrite provides a focused overview of its Spring 2026 Release, highlighting new capabilities designed to help investigative teams move faster, access more data, and collaborate more effectively across digital investigations.

Watch the full webinar here: https://www.forensicfocus.com/webinars/inside-the-cellebrite-spring-2026-release/