A round-up of today’s digital forensics news and views:
Tools & Software
MemProcFS-Analyzer v1.3.0 Adds CLI and New FindEvil Alerts
MemProcFS-Analyzer v1.3.0, a PowerShell script for automated Windows memory dump analysis, now supports command-line execution for batch processing and automation workflows. New FindEvil alerts flag PRIVATE_RX with high entropy for possible encrypted injected payloads and THREAD with BAD_MODULE for injected code, while 803 custom YARA rules and Zircolite v4 expand detection coverage. Amcache analysis gains experimental SQLite database support, and kernel-based fallback improves memory dump fingerprinting when registry data is absent.
RabbitHole Adds RealmDB, MMKV, Mozilla Support
RabbitHole has released a new version adding support for RealmDB, MMKV, and Mozilla browser artifacts, expanding its forensic coverage. SQLite handling gains inline timestamp decoding, faster filter query generation, and a new Insights tab that flags table relationships and potential data gaps at a glance.
Velociraptor Gains Linux Autoruns Persistence Artifact
A new Velociraptor artifact authored by Matt Green deploys Microsoft’s Sysinternals Autoruns for Linux, enumerating autostart and persistence mechanisms across services, timers, cron jobs, loaders, browser extensions, and more. It supports amd64 and arm64 systems running glibc 2.28 or later, unpacking the Rocky Linux 8 RPM in a temporary directory without executing any discovered commands. Investigators can optionally calculate SHA256 hashes of resolved image paths and scan alternate roots such as mounted disk images or container filesystems.
Research & Techniques
Chrome SQLite Database Evolution Charted for DFIR
A comprehensive reference mapping how Chrome’s SQLite databases have changed across versions gives browser forensics practitioners a structured view of artifact evolution. Covering 13 years of Chrome database schema changes, the resource goes significantly further than earlier versions of the same chart.
Case Studies
LAVA Field Guide for LEAPP Case Review
LAVA, the visualization and analysis companion to the LEAPP family of mobile forensic tools, supports structured case review through tagging and export workflows. Practitioners working with iLEAPP, aLEAPP, or related parsers can use LAVA to organize artifact findings and produce exportable case output for reporting.
