A round-up of this week’s digital forensics news and views:
Courtroom Push Against DFIR Experts Raises Evidence Concerns
Prosecutors in some jurisdictions are arguing that mobile device evidence can be introduced without digital forensic experts, especially when common tools produce seemingly clear outputs. That stance risks glossing over acquisition limits, parsing errors, timestamps, deleted data, and app artifacts. Practitioners are urged to document tool limitations and press for expert testimony where interpretation matters.
Windows 11 PCA Trace Adds A New Execution Artifact For Investigators
Windows 11 22H2 and later record some Explorer-launched programs in a plain-text PCA file, giving investigators a new execution artifact to check. Andrea Fortuna explains where it lives, what it captures, and how to collect or parse it during triage. He also notes key limits, including its focus on Explorer launches rather than all process starts.
Lost Apples 2.0 Expands Ios Find My Proximity Forensics
Lost Apples 2.0 adds new ways to analyze Apple Find My data for device proximity work. It can derive beacon keys from OwnedBeacons, compare them with Wild Mode alerts and Observations.db, and help link AirTags or iPhones to an iCloud account. Tests show the method can surface nearby powered-down devices, a useful lead in mobile forensics.
Read more (thebinaryhick.blog)
Rob Fried Discusses AI, Remote Collections, And Forensics Practice
Rob Fried says AI, remote collection and data culling are reshaping digital forensics. He tells the Forensic Focus podcast that examiners need stronger documentation, clear guardrails and better people skills as workflows move to cloud and targeted collection models.
Report Warns AI-Generated Child Abuse Imagery Is Escalating
A new report says AI-generated child sexual abuse imagery is advancing rapidly and causing real harm to children. It draws on analyst views and dark web discussions to show how offenders exploit easy access to synthetic abuse content. The findings add urgency to calls for safety-by-design rules and mandatory testing before AI products launch.
Aid4Mail Pushes LLM Email Review Beyond Keywords
Fookes Software argues keyword searches and TAR can miss context-rich evidence in large, multilingual email sets. It says Aid4Mail uses LLM-based classification without seed training, and benchmark tests found strong recall and precision, with one 34,097-email run costing under $23.
Webinar Highlights Vehicle Systems Forensics In Murder Case
A forthcoming webinar examines a complex murder investigation involving Lancashire Constabulary and vehicle systems forensics. It focuses on case strategy, preparing expert reports for court, and understanding the source of evidence. The session should interest digital forensic practitioners and those handling vehicle data in serious crime or collision work.
Read more (training.harpershaw.co.uk)
AI-Generated CSAM Videos Surge In Severity And Volume
AI-generated child sexual abuse videos rise sharply, with analysts identifying 3,443 cases in 2025 compared with 13 a year earlier. Most are rated in the most serious category, suggesting synthetic media is driving more extreme abuse content and raising urgent challenges for investigators and child protection teams.
Survey Seeks Evidence On Digital Forensics Well-Being
A survey backed by Northumbria University aims to gather evidence on the mental health and wellbeing of digital forensic practitioners. Researchers say stronger data can help agencies build better support, shape policy, and treat investigator wellbeing as a real occupational health issue. Participation is anonymous and open to practitioners across law enforcement, academia, contracting, and the private sector.
Read more (app.onlinesurveys.jisc.ac.uk)
New Post Explores ALEAPP Use With ALEX PRFS Backups
A new blog post looks at how ALEX PRFS backups can complement ALEAPP processing in Android investigations. It highlights a practical option for triage when a full file system extraction is not yet available. Investigators may still recover useful log data instead of waiting for broader device support.
London Judge Probes Smart Glasses Use During Witness Testimony
A London High Court judge says a witness in an insolvency hearing may have been coached through Bluetooth-enabled smart glasses while testifying via a Lithuanian interpreter. Suspicious pauses and reported technical interference pushed device pairing behavior and call records into focus, a reminder for DFIR teams that consumer wearables can complicate evidence integrity in regulated settings.
