This Week on Forensic Focus
How A MacBook With A Broken Screen Helped Convict A UK Property Fraudster: Belkasoft X Case Study
A broken MacBook, an iPhone, and a £113,000 fraud case – discover how Belkasoft X helped uncover crucial digital evidence that brought…
AI For Investigations: 5 Myths, Debunked
Discover the truth behind five common myths about AI in investigations, with real-world insights from investigators using Cellebrite Genesis.
How Detego Global’s AI Technology Is Transforming Child Abuse Investigations
Discover how AI-powered digital forensics is helping investigators accelerate child abuse investigations, identify critical evidence faster, safeguard victims, and reduce exposure to…
CCTV Review Under Pressure: How S21 CCTV Helps Investigators Find What Matters Faster
Semantics 21’s Tom Oldroyd shows how S21 CCTV uses offline AI to cut hours of CCTV, body-worn and dash cam footage down…
Dead Ends And Data Recovery: The Importance Of Remaining Tool Agnostic In Digital Forensics
When standard forensic tools hit a dead end, expertise makes the difference – discover how Page One’s Jeffrey Lehn uncovered critical vehicle…
Page One’s Rob Fried And Andrew Milauskas On Using AI In Digital Forensics And E-Discovery
Rob Fried and Andrew Milauskas join the Forensic Focus Podcast to talk about forensics.expert, Rob’s free AI knowledge portal for digital forensics,…
Elsewhere in DFIR
- 1
iOS Biome SEGB File Format Explained for Examiners
iOS Biome stores device-activity data in SEGB files under /private/var/mobile/Library/Biome/streams/restricted, with two distinct versions: v1 places the SEGB magic bytes at offset 52, while v2 (iOS 17+) leads with the magic and adds a reverse-ordered trailer tracking entry state and Cocoa timestamps. Entries marked deleted may still contain recoverable data and should be parsed and reported with their state noted. Read more (learn.hexordia.com)
- 2
Stark4n6 StartMe Adds New DFIR Tools
Kevin Pagano's November 2026 Forensics StartMe update adds several community resources, including Dumplyzer, an open-source memory forensics platform for DFIR and malware analysis, and GLEAPP, an image and video forensic triage toolkit. A new CCTV Log Analyzer supports extraction of system logs from Hikvision, Dahua, and TVT DVR/NVR disk images, expanding options for practitioners working multimedia evidence. Read more (stark4n6.com)
- 3
Unfurl Decodes Hidden Facebook Click Identifiers
Facebook and Instagram fbclid parameters now encode click timestamps, source app identifiers, and browser IDs within their values. Unfurl can automatically decode these parameters, surfacing investigative artifacts from URLs that previously appeared opaque. Read more (hindsig.ht)
- 4
UK Admits 20,000-Device Digital Forensics Backlog
The UK Home Office has acknowledged that digital forensic backlogs represent a significant challenge, with an estimated 20,000 devices awaiting analysis at any given time across police units. Ministers admitted the department holds no data on average processing times or how many criminal cases are delayed. A new National Police Service is being established, with a dedicated director of forensic services appointed to centralise digital forensics operations and address capacity pressures. Read more (publictechnology.net)
- 5
Plaso Plugin Allows False Timeline Entry Injection
A vulnerability in Plaso's GoogleAnalyticsUtmzPlugin allowed malicious websites to overwrite tool-assigned timeline metadata fields, including data_type and parser, by crafting __utmz cookie values. A forged cookie could make a Firefox cookie entry appear as Chrome browser history or a file system stat event, misleading analysts and automated tooling. Remaining indicators include the pathspec pointing to the cookie database and an accompanying cookie entry for the originating host. Read more (osdfir.blogspot.com)
