Forensic Focus Forums - Recent Topics

Webinar: Finding Answers Faster: Genesis For Private Sector Investigations

Zoe — Mon, 21 Sep 2026 16:00:00 +0000

Cellebrite's Matt Goeckel demos Genesis on a real enterprise case - UFDRs, CDRs, documents, audio and video - showing how agentic AI surfaces leads and timelines while linking every finding back to its source.

Watch the full webinar here: https://www.forensicfocus.com/webinars/finding-answers-faster-genesis-for-private-sector-investigations/

Webinar: Finding Answers Faster: Genesis For Private Sector Investigations

Zoe — Mon, 21 Sep 2026 15:59:18 +0000

Watch the full webinar here: https://www.forensicfocus.com/webinars/finding-answers-faster-genesis-for-private-sector-investigations/

A Stab Vest Is Protection. DFIR Resilience Is Not.

Zoe — Thu, 17 Sep 2026 14:59:32 +0000

We would never tell a police officer to face a blade with “resilience” instead of body armour, so why do we expect digital forensic investigators to face repeated trauma with little more than resilience to protect them?

Read the full article here: https://www.forensicfocus.com/articles/a-stab-vest-is-protection-dfir-resilience-is-not/

Forensic Imaging Is A Workflow Problem, Not Just A Speed Problem

Zoe — Tue, 15 Sep 2026 10:50:42 +0000

Atola TaskForce 2 helps forensic labs reduce imaging backlogs by combining fast parallel acquisition, automation, smarter workflows, and high-speed connectivity to keep evidence moving.

Read the full article here: https://www.forensicfocus.com/articles/forensic-imaging-is-a-workflow-problem-not-just-a-speed-problem/

Before acquisition: should first response be driven by the observed state?

lmolinario — Sun, 13 Sep 2026 06:32:28 +0000

When approaching a powered-on computer, one of the first decisions may come before choosing an acquisition method: should the current state be maintained, or deliberately changed?

A running system may be unlocked, have encrypted volumes already mounted, contain useful volatile data, maintain authenticated sessions, or depend on network resources that may no longer be available after isolation or shutdown.

But maintaining that state is not neutral either. Processes continue to run, logs change, applications write data, synchronization may continue, and remote access or destructive activity may still be possible.

This makes the usual options difficult to reduce to a fixed sequence.

Network isolation may reduce the risk of remote interference, but it can also break active sessions or dependencies.

Live collection may preserve memory, encryption material and other volatile information, while necessarily introducing its own footprint.

Shutdown may stop ongoing activity, but it can also destroy volatile state or turn an accessible encrypted system into one that is much harder — or impossible — to access afterwards.

This makes me wonder whether first-response guidance should begin less with a predefined procedure and more with the observable state of the system.

For example:

power and lock state;
encryption and access state;
mounted local or remote storage;
active sessions;
network dependencies;
volatile information likely to be lost;
indications of ongoing remote or destructive activity.

The available options could then be compared in terms of what they preserve, what may be lost, what footprint they introduce, and how reversible the decision really is.

By reversible, I do not simply mean whether an action can technically be undone. I mean whether the evidential state that existed before the action can realistically be recovered.

For those who regularly deal with powered-on systems: which observable states actually make you change your normal first-response approach?

And are there situations where you deliberately maintain the current state rather than immediately isolating, collecting, or shutting the system down?

Interested to hear how others approach this in practice.

Forensic help needed: locating Tuya/ThingClips IPC Privacy Zone configuration and history

mixen — Sat, 12 Sep 2026 08:22:28 +0000

I am examining an Android IP camera application with package name:

com.fnk.fnk

The APK contains Tuya/ThingClips-related IPC components.

Relevant strings/resources found in the APK include:

ENABLE_PRIVACY_MODE_BUTTON_ATTRIBUTE_ID
ipc_set_privacy_mode_switch
ipc_set_privacy_zone_settings
ipc_private_area_tips
privacy_zone_set_point

The app data directory is:

/data/user/0/com.fnk.fnk/

I have confirmed that these functions/resources exist, but I now need help identifying the actual forensic artifacts that store the configuration and history.

I am specifically trying to determine:

1. Which database, SharedPreferences file, XML/JSON file, device property or DP ID stores Privacy Mode / Privacy Zone / Private Area settings?

2. Where are the coordinates or geometry of privacy zones stored?
For example x/y values, width/height, rectangle coordinates or polygon points.

3. Is there any local Android artifact or cloud/device log showing when a privacy zone was enabled, changed or deleted?

4. Can the account or device that changed the privacy setting be identified?

5. Is ENABLE_PRIVACY_MODE_BUTTON_ATTRIBUTE_ID likely only a UI feature flag, or could it map to a Tuya/ThingClips device property?

6. Does privacy_zone_set_point look like a persisted zone-coordinate function, and where would you expect those values to be stored?

I have access to the APK and an extraction of the application files from the phone.

Any suggestions for specific databases, SharedPreferences files, SDK classes, DP IDs, log files or forensic artifacts to examine would be greatly appreciated.

This concerns forensic examination of an owned camera system.

The Sound Of Silence – What Institutional Silence On DFI Well-Being Actually Tells Us

Zoe — Thu, 10 Sep 2026 15:46:24 +0000

When six organisations receive evidence that one in five digital forensic investigators meet the clinical threshold for suicidal or self-harm ideation, and only one responds, what does that silence say about who is looking out for the profession?

Read the full article here: https://www.forensicfocus.com/articles/the-sound-of-silence-what-institutional-silence-on-dfi-well-being-actually-tells-us/

Digital vs Computer Forensics

wlygon7 — Thu, 10 Sep 2026 01:38:13 +0000

Hello everyone, I'm current a college freshman getting a AS in Networking/Cybersecurity. I want to be a Computer Forensic Specialist (dealing with criminal's hard drives using hashing, write blockers, autopsy, documentation etc.), probably/hopefully working for my state's bureau of investigation. However when researching for what I need educationally (Degrees and Certs) I have found that my field is also often used with the term Digital Forensics, which (if I understand it correctly) leans more towards investigating cyberattacks. While this does sound fun, I would not want to do this for my job, I have a natural incline towards hardware and find it more interesting, no offense to anyone doing this as a job, y'all are awesome for that!

So it begs the question: What is the proper term for the forensics I want to do? And if anyone happens to know it, what degree/certs would I need to do this/that would help me? I appreciate any help I could get, thank you all!

After the decrypt: how do you actually triage a network-scale message set?

antonsen — Thu, 03 Sep 2026 17:43:58 +0000

Working on triage methods for large communication sets, I keep coming back to a handoff problem that doesn't get much airtime: the moment cryptographic recovery succeeds and the linguistic problem begins.

A takedown-scale corpus (think EncroChat or Sky ECC proportions) lands as plaintext: hundreds of thousands of messages, a dozen languages, thousands of participants, no single device owner to anchor the analysis. The technical recovery disciplines have done their job. Now someone has to answer the only question the case team actually has: which conversations do we read first?

The reflexive move is keyword search built from the case brief. In my experience it fails in both directions at this scale, too broad and you're handed a hundred thousand hits; too narrow and you miss the case material entirely, because participants have often already adapted their language (codewords drifting into slang, operational-security instructions, deliberate obfuscation — especially post-takedown, when they know the platform is burned).

I've been working on a layered alternative: a source-cited lexicon pass for the first cut, then behavioural/co-occurrence signals to catch the adapted exchanges keywords miss, producing a ranked reading order rather than a binary hit list, with each flag traceable to why it was raised.

But I'm genuinely curious how teams handle this in practice today:

When a decrypted network-scale set lands on your desk, what's your actual first move? Case-brief keyword lists? Sampling? Participant-first prioritisation? Something more structured?
The question that interests me most: if a defence team later asks "why wasn't this thread reviewed earlier?" What does your answer look like? Is there a documented rationale behind your triage order, or does it live in the examiner's head?

Happy to compare notes with anyone working the same problem.

/Andreas

“The Skills And Resilience To Do One Of The Hardest Jobs In Policing” — Why This DFIR Recruitment Language Gets The Evidence Wrong

Zoe — Thu, 03 Sep 2026 13:28:42 +0000

Does recruiting for “resilience” risk putting responsibility in the wrong place? Paul Gullon-Scott looks at what the evidence says about digital forensic well-being, workload and organisational support, and why the language we use matters.

Read the full article here: https://www.forensicfocus.com/articles/the-skills-and-resilience-to-do-one-of-the-hardest-jobs-in-policing-why-this-dfir-recruitment-language-gets-the-evidence-wrong/