A round-up of today’s digital forensics news and views:
Forensic Focus News
How A MacBook With A Broken Screen Helped Convict A UK Property Fraudster: Belkasoft X Case Study
Digital forensic examiner Mark Morris of Aardvark Forensics used Belkasoft X to extract evidence from a damaged MacBook and an iPhone belonging to Jason Cunningham, a UK rent-to-rent property fraudster who defrauded 15 victims of over £113,000. An external monitor, keyboard, and docking station enabled a full Time Machine backup from the broken laptop, with AweClone providing a second acquisition method. Keyword searches across WhatsApp, iMessage, and SMS confirmed victims’ accounts, and Cunningham was sentenced to four and a half years at Reading Crown Court in November 2025.
Research & Techniques
Azure Cloud Incident Response Field Reference
Azure and Microsoft 365 forensics requires a fundamentally different approach from traditional disk-based investigation, as evidence is ephemeral, metered, and often disabled by default. This reference covers the full Azure resource hierarchy, Entra ID and RBAC permission systems, log sources for detection, and concrete attack paths including service principal credential abuse with specific audit log fields to query. Detection guidance ties Entra ID Audit logs and Sign-In logs directly to attacker techniques, giving examiners a clear starting point during live investigations.
Chromium File System Storage Persists After History Clearing
Clearing browsing history in Chromium-based Android browsers leaves File System API storage intact, including folder names, file names, and file contents written by visited sites. Both the legacy webkitRequestFileSystem and newer Origin Private File System APIs store data in the same location, accessible across Chrome, Edge, Samsung Internet, DuckDuckGo, and WebView-based apps. ALEAPP will add three new artifacts covering Sites, Bucket Storage, and Files in its next release.
Hunting AI-Aided Intrusions via Behavioral Artifacts
A practitioner working in a global MDR environment outlines six analytical pillars for identifying AI-assisted or agentic attacker behavior in intrusion logs, including dependent permutation, software versioning mismatches, and timing intervals. Entra sign-in and directory audit logs from the Huntress SkyKick/ARTEX case illustrate how error-handling changes between runs expose AI-driven adaptation.
iOS PList and NSKeyedArchiver Artifacts Explained
iOS stores app data in property lists that can be XML or binary, but converting binary plists to XML does not mean the data is human-readable. Apps using NSKeyedArchiver serialize objects into a flat $objects array with UID cross-references, requiring examiners to manually rebuild object relationships. Nested NSData fields can contain additional serialized formats, including protobuf.
Read more (learn.hexordia.com)
Tools & Software
LogsTotal Runs Multi-Engine Sigma Detection on Logs
LogsTotal is a self-hosted, open-source platform that runs five Sigma detection engines, including Chainsaw, Hayabusa, and Zircolite, simultaneously against uploaded Windows EVTX, auditd, syslog, and Sysmon logs. Findings are grouped by severity with MITRE ATT&CK heatmaps, process trees, entity pivoting, and export to STIX, MISP, and IOC feeds.
iVe 5.1 Adds 25 Vehicle Acquisition Profiles
Berla has released iVe 5.1, adding 25 new acquisition profiles across 15 vehicle system variants for Stellantis, Hyundai/Kia, Ford, and Volkswagen Group systems. New probe acquisition profiles offer non-destructive memory access without vehicle power, while 14 chip-off import profiles extend physical acquisition options. Forty new instructional resources cover system removal, disassembly, and acquisition preparation.
Industry News
Research Compiles 89 DFIR Mental Health Statistics
A new open resource compiles 55 sources and 89 statistics on mental health in DFIR, incident response, and SOC roles, grading each by evidential quality. One in five digital forensic investigators reported clinically significant suicidal or self-harm thoughts, while 86% rarely or never receive a peer debrief after difficult casework. Supervisor support and manageable workloads, not wellness perks, emerge as the strongest protective factors.
Read more (depalmar.github.io)
AI in DFIR: Curated Reading List
A curated collection of AI-focused writing for DFIR practitioners assembles perspectives from prominent voices including Brett Shavers, Brian Carrier, and Rob Lee. Topics span local LLMs, prompt engineering for evidence analysis, AI workflow integration, hallucination risks, and when not to use AI during collection.
Training & Events
Free Blockchain CSAM Investigator Training in Brooklyn
The US Secret Service and TRM Labs are co-hosting a free two-day Minuteman Sprint in Brooklyn on November 9, 10, targeting ICAC investigators. Attendees will learn to apply blockchain intelligence to identify CSAM consumers, interpret crypto Cybertips, obtain data from virtual asset service providers, and draft affidavits.
