A round-up of this week’s digital forensics news and views:
Industry News
£2.4M Police Well-Being Fund: What It Buys
The UK Home Office has committed £2.4 million to police mental health through the National Police Wellbeing Service, funding 150,000 annual psychological assessments, a sleep app, a crisis line, and trauma-tracking guidance. Divided across 234,425 FTE police employees, that amounts to roughly £10.24 per head — around 85 pence per month. FOI data from 43 forces reveals only 36% have adopted Enhanced Well-Being Standards, with resourcing gaps at force level undermining nationally designed frameworks, particularly for high-exposure roles like digital forensic investigators.
Legal & Policy
Data-Driven Method Improves Cloud Search Warrants
Investigators drafting cloud search warrants should build requests around what providers actually retain, not generic boilerplate demands for all account data. Combining user-generated “digital footprints” with system-generated “digital exhaust” improves probable cause, particularity, and legal defensibility. Privacy policies, law enforcement guides, and provider retention disclosures offer a concrete roadmap for targeted, technically accurate warrant language.
Read more (magnetforensics.com)
Tools & Software
Timestamped Brings DCode-Style Forensics to macOS
Digital forensic practitioner Joshua Hickman has released Timestamped, a new macOS-native timestamp decoding tool inspired by the long-running Windows utility DCode. Built in Swift, it supports dozens of forensic timestamp formats, including Unix, APFS, HFS+, Windows FILETIME and Chromium timestamps, with more formats planned.
Read more (thebinaryhick.blog)
Industry News
CTF Training Limits Real DFIR Investigation Thinking
Brett Shavers argues that CTF challenges, with their fixed correct answers, may condition DFIR practitioners to expect a single solution — a habit that doesn’t transfer well to real investigations where evidence is ambiguous and conclusions aren’t predetermined. Real casework demands analytical flexibility that structured competitions rarely develop.
Industry News
HMICFRS Report Flags Crisis in Investigator Well-Being
Only 43% of OCSAE and MOSOVO practitioners feel supported in their work, according to the 2025 National Police Wellbeing Survey, and self-referral systems are failing investigators who cannot recognise or safely disclose their own distress. Digital forensic investigators face caseloads of up to 54 simultaneous cases and device examination backlogs stretching two years, compounding chronic traumatic stress exposure. Forces reinspected in 2023–25 showed deteriorating well-being provision despite earlier formal causes of concern.
Tools & Software
Volatility Plugin Contest 2026 Now Open
The 14th annual Volatility Plugin Contest is now accepting submissions through 31 December 2026, inviting DFIR practitioners to develop and share open-source memory forensics plugins. Contributors can win cash prizes while gaining visibility across the digital forensics community.
Read more (volatilityfoundation.org)
Tools & Software
iLEAPP and ALEAPP Updated With Major App Artifacts
iLEAPP and ALEAPP have both reached v2026.3.1, adding artifact support for Snapchat, Tinder, TikTok, Reddit, Proton Mail, WhatsApp, and Chrome payments across iOS and Android. Mobile forensic examiners can now parse data from these widely-encountered apps directly within both tools.
Research & Techniques
Samsung Digital Wellbeing Yields Key Forensic Artifacts
Samsung’s Digital Wellbeing feature stores forensic artifacts that can reveal timezone changes on a device, offering investigators a new data source for timeline reconstruction. These findings appear specific to Samsung’s implementation and provide mobile examiners with additional corroborating evidence during investigations.
Research & Techniques
7-Zip Registry Artifacts Reveal Data Exfiltration Activity
Registry keys under Software\7-Zip\FM — specifically PanelPath0, FolderHistory, and CopyHistory — can reveal when an attacker used 7-Zip to access raw physical devices or sensitive directories like NTDS and System32\config. The PanelPath0 value stores the last browsed path, while FolderHistory records previously accessed folders in an MRU-style list, functioning as a forensic indicator of suspicious exfiltration activity. New RegRipper plugins for FolderHistory and CopyHistory are in development, giving examiners additional parsing capability.
Training & Events
IACIS ICMDE: Budget-Friendly DFIR Certification Reviewed
The IACIS ICMDE is one of the more affordable entry-to-intermediate certifications available to digital forensics and mobile forensics practitioners. Covering Android and iOS investigation fundamentals, it offers a structured credential path without the steep cost of better-known alternatives.
Read more (matthewplascencia.substack.com)
Research & Techniques
NTFS VHD Exploits: Sigma Rules and IOCs
Three heap-based buffer overflows in ntfs.sys—CVE-2026-50471, CVE-2026-50494, and CVE-2026-58640—are all triggerable via a single malicious VHD file mounted through normal Windows Explorer interaction. Patched in July 2026 cumulative updates, the flaws enable SYSTEM-level privilege escalation from low-privilege local access, with Positive Technologies noting a detection evasion window before security tools respond. DFIR practitioners can deploy Sigma rules keyed on disk-image mount lineage, Windows Event IDs 55/130/137, and Sysmon Event IDs 1 and 11 to identify exploitation attempts pre- and post-patch.
Case Studies
Backdoor Hides C2 Domain in Whitespace
A 12 KB Windows implant disguised as Realtek audio software encodes its C2 domain inside C:\ProgramData\desktop.ini by counting trailing spaces per line, with each space count mapping to an ASCII character. Persistence runs via a WMI event subscription on Win32_LocalTime triggering at 19:50, followed by an ICMP knock before POSTing to the C2. Defenders can hunt for EventFilter/CommandLineEventConsumer pairs bound to Win32_LocalTime and flag any desktop.ini containing non-whitespace data beyond byte 174.
Training & Events
Best DFIR Training Courses for 2026
A curated list of top DFIR training courses and online programmes for 2026 gives practitioners a structured starting point for professional development. Courses spanning digital forensics and incident response disciplines help examiners at all levels benchmark and advance their skills.
Case Studies
Forbes Covers Digital Investigation Breakdown Study
Forbes highlights a new research effort from digital forensics expert Brett Shavers and Magnet Forensics examining where digital investigations break down in practice. The initiative comes as AI is rapidly entering forensic tools, raising concerns about validation, repeatability and the risk of unverified machine-generated findings being treated as evidence.
