This Week on Forensic Focus
Cyber Unpacked S3:E2 // IR Beyond Malware: Investigating Business Email Compromise And Fraud
Ransomware gets the headlines, but business email compromise quietly drains billions every year: Doug Metz and Jeff Rutherford from Magnet Forensics show how to investigate it in Microsoft 365, from forwarding rules and OAuth abuse to a full AXIOM Cyber case walkthrough.
Elsewhere in DFIR
- 1
Hayabusa v4.4.0 Scans Event Logs from Disk Images
Hayabusa v4.4.0 adds direct Windows event log scanning from VHDX and E01/Ex01 disk images, eliminating the need to mount or extract images beforehand. Examiners can now run analysis without administrator privileges across Windows, Linux, and macOS platforms. Read more (github.com)
- 2
Open-Source Tool Extracts, Grades Forensic Media
A new MIT-licensed tool, Forensic Media Extractor, reads E01, raw, VM images, live devices, UFDR and phone packages, recovering images and video via file system parsing, deleted entry recovery and carving. Results are graded in a browser interface backed by a shared hash store, then exported to Project VIC, Griffeye, C4All and LAVA. Read more (github.com)
- 3
New Open-Source Tool Reads Windows Registry Hives Offline
A new open-source tool called regfprobe reads Windows registry hives offline and read-only, supporting SYSTEM, SOFTWARE, SAM, NTUSER.DAT, Amcache.hve and others directly from E01 or raw disk images without prior extraction. Dirty hives are handled by replaying transaction logs in memory, with a trust indicator displayed to the examiner. Cross-platform executables and a single-file Python option are available under the MIT licence, and upcoming DLEAPP releases will use regfprobe as their registry parsing backend. Read more (leapps.org)
- 4
Windows ETL Files as a Forensic Evidence Source
ETL (Event Trace Log) files, produced by Windows Event Tracing, can capture process activity, file operations, and network communications that EVTX event logs may not record or may have lost to attacker deletion and log rotation. Acquisition options include robocopy for live collection, KAPE targets for structured triage, and a Volatility 3 plugin called etw-scan for recovering buffered events from memory images. Investigators should verify provider list and time range coverage when examining any ETL file. Read more (sumeshi.github.io)
- 5
Free Mobile Device Preservation Course Launches
A free short-form course on mobile device preservation covers seizure procedures, consent, warrants, Faraday isolation, device state management, and chain of custody documentation. These foundational steps directly affect evidence admissibility and are critical for DFIR practitioners handling mobile evidence. Read more (learn.hexordia.com)
