A round-up of today’s digital forensics news and views:
Research & Techniques
Windows ETL Files as a Forensic Evidence Source
ETL (Event Trace Log) files, produced by Windows Event Tracing, can capture process activity, file operations, and network communications that EVTX event logs may not record or may have lost to attacker deletion and log rotation. Acquisition options include robocopy for live collection, KAPE targets for structured triage, and a Volatility 3 plugin called etw-scan for recovering buffered events from memory images. Investigators should verify provider list and time range coverage when examining any ETL file.
Tools & Software
Arsenic v4 Mobile Triage Tool Released Free
North Loop Consulting has released Arsenic v4, a free mobile device triage tool for iOS and Android, originally built for ICAC investigations. Version 4 adds SQLite-based case tracking, multi-device support per case, new parsers, improved PDF reports, and item tagging. Consent-based and cross-platform, it runs on Mac and Windows to help examiners reduce over-collection at search scenes.
Read more (northloopconsulting.com)
STViewer: Open-Source Email Archive Forensics Tool
STViewer is a free, open-source desktop tool for Windows, macOS, and Linux that opens PST, OST, mbox, Gmail Takeout, Thunderbird, Apple Mail, and EML archives. It indexes headers, message bodies, and attachment text, and surfaces SPF/DKIM/DMARC validation results alongside full delivery-path analysis for each message.
LAVA 2026.1 Adds Timeline and List View
LAVA 2026.1 introduces a case-wide timeline with per-artifact lanes and event counts, a unified list view exportable to CSV or HTML, and a case-wide time window filter. Conversation exports now include tags, colors, and an HTML format with embedded video playback, while reports gain case number, agency, and examiner header fields.
Training & Events
Free Bifract Lab Delivers 2M-Event DFIR Challenge
Bifract Labs has released Meridian, a free hands-on lab dropping practitioners into a simulated Windows domain intrusion spanning 2.08 million events across five hosts, with Sysmon, Windows Event Logs, Zeek telemetry, and Velociraptor-collected Autoruns data. Thirty-one investigative challenges walk through initial access, persistence, credential access, and lateral movement, with hints and a full guided walkthrough. Bifract, the open-source log analysis platform underpinning the lab, runs on ClickHouse and includes process provenance graphs, beacon detection, and Sigma-based alerting, launchable instantly via GitHub Codespaces.
Cyber Triage Publishes Windows Artifact Forensics Series
Cyber Triage has released a multi-part forensic analysis training series covering key Windows artifacts including Shellbags, Jump Lists, UserAssist, WMI malware traces, NTUSER.DAT, ShimCache, and AmCache. Each module targets artifacts routinely encountered during Windows investigations, offering practitioners structured reference material for common examination tasks.
Packt Hosts Memory Forensics Live Training
Packt is offering a two-day virtual live training course covering practical threat hunting with memory forensics, endpoint telemetry, and AI-driven investigations, led by Monnappa K A. Scheduled for January 28-29, 2027, the course is available at a discounted rate of $369.99.
