This Week on Forensic Focus
End-To-End Digital Investigations: From First Access To Final Verdict
Discover how Magnet Forensics’ integrated platform, from Graykey and Axiom to Automate, Review and Verify, helps agencies cut backlogs, collaborate in real…
Agentic AI For Digital Investigations: Matt Goeckel Introduces Cellebrite Genesis
Cellebrite’s Matt Goeckel joins the Forensic Focus Podcast to talk about Genesis, an AI tool that lets investigators ask questions of their…
Explore Cellebrite’s Autumn 2026 Release: Discover What’s New
Discover how the Cellebrite Autumn 2026 Release is transforming digital investigations with faster access to evidence, AI-powered insights and seamless collaboration.
Preparing Digital Multimedia Evidence For Court: What To Consider Before Presentation
Effective courtroom presentation starts with careful preparation – discover how Amped Replay helps forensic professionals prepare clear, accurate and properly documented digital…
Elsewhere in DFIR
- 1
Eric Zimmerman Tools Move to .NET 10
Eric Zimmerman's forensic toolkit has released its October 2026 update, migrating all tools to .NET 10 LTS from .NET 9, with AmcacheParser, VSCMount, and WxTCmd among those updated. The suite covers registry analysis, MFT parsing, jump lists, shellbags, event logs, and dozens of other Windows artifact categories relied on daily by examiners. Read more (ericzimmerman.github.io)
- 2
Instagram Assisted Capture Tool Automates OSINT Collection
A new Instagram Assisted Capture feature is coming to the Forensic OSINT browser extension, automating the process of opening posts, expanding comment threads, and cycling through carousels across a user-defined date range. SHA-256 hashing on every captured file and comment-count verification against Instagram's reported figures add forensic integrity to the workflow. Practitioners retain control, confirming each capture individually with the option to pause or stop at any point. Read more (linkedin.com)
- 3
Hardware Breakpoint Captures Windows Hello PIN
A new open-source project, WHFB-PinCapture, captures Windows Hello for Business PINs at entry by placing a CPU hardware breakpoint on NgcSerializeConvenienceCredential inside LogonUI.exe, reading the PIN from thread context via a Vectored Exception Handler without modifying any code. This approach bypasses VBS/VSM and TPM protections that make offline PIN recovery impossible, providing a reliable capture-at-entry method for environments where the examiner has elevated administrator access. A companion PowerShell script, Get-WHFBKeys.ps1, enumerates WHFB, NGC, and TPM key material and outputs a JSON report. Read more (github.com)
- 4
Android Battery File Yields Ten Days of App History
Android's batterystats-daily.xml stores up to ten days of battery discharge and charge steps alongside package install and update records, offering examiners a corroborating timeline artifact across Android 11 to 16. The file encodes battery level, screen state, and app version codes in a compact hex format, with uninstalls recorded as version zero rather than a distinct element. An existing ALEAPP parser covers both plain XML and Android Binary XML variants, though an earlier misreading of the screen-state mode letters has now been corrected. Read more (bebinary4n6.blogspot.com)
- 5
Open-Source Toolkit Targets Compromised Edge Device Forensics
A free, open-source Edge DFIR Toolkit now covers forensic investigation of 10 network edge platforms including FortiOS, Ivanti Connect Secure, PAN-OS, and NetScaler. It catalogs 92 artifacts with volatility-ordered, read-only collection plans, 142 detections with Sigma and YARA rules, and per-CVE exploitation timelines. Response playbooks open with explicit "do not" lists to prevent evidence destruction on devices that cannot be imaged or agented. Read more (github.com)
