A round-up of today’s digital forensics news and views:
Tools & Software
Hayabusa v4.4.0 Scans Event Logs from Disk Images
Hayabusa v4.4.0 adds direct Windows event log scanning from VHDX and E01/Ex01 disk images, eliminating the need to mount or extract images beforehand. Examiners can now run analysis without administrator privileges across Windows, Linux, and macOS platforms.
Open-Source Tool Extracts, Grades Forensic Media
A new MIT-licensed tool, Forensic Media Extractor, reads E01, raw, VM images, live devices, UFDR and phone packages, recovering images and video via file system parsing, deleted entry recovery and carving. Results are graded in a browser interface backed by a shared hash store, then exported to Project VIC, Griffeye, C4All and LAVA.
Juntei: Fast Windows DFIR Artifact Parser Released
Juntei is a new open-source, cross-platform Windows DFIR artifact parsing tool built for speed and stability, supporting directory scans plus VHDX and E01 container ingestion. It processed 125 GB of triage data in under five minutes on an Apple M4, outputting 40 GB of parsed results. JSONL supertimelines are formatted for direct Timesketch import, and CSV output integrates with IRFlow Timeline templates.
Read more (yamato-security.github.io)
Legal & Policy
PSNI Kept Cellebrite Data Past Court Deletion Order
Northern Ireland police retained Cellebrite-extracted journalist data for years beyond a 2020 court-ordered deletion deadline, with copies found on a Police Cyber Crime Centre system that could not be fully removed from backup tapes. Separate cases in Germany and Italy raise parallel questions about proportionality, retention limits, and prosecutorial disclosure of which extracted files were relied upon as evidence. Because whole-phone extraction captures data beyond any single offense, courts and statutes remain the only mechanism constraining scope and retention.
Preserving OSINT Evidence for Court Admissibility
Ephemeral social media content, including Stories that vanish in 24 hours, poses serious preservation challenges for investigators relying on digital evidence. Screenshots alone may fail under the Best Evidence Rule, as illustrated by Edwards v. Junior State of America Foundation, where missing native files led to excluded evidence. Investigators need verified, court-ready collection methods to prevent evidence loss before litigation.
Research & Techniques
ShellBags NodeSlot Values Explained for Examiners
ShellBags Explorer’s “Has Explored” column depends on NodeSlot values embedded in ShellBag artifacts, and understanding these values changes how examiners interpret folder activity on Windows systems. NodeSlot data reveals whether a folder was genuinely explored by a user, adding precision to timeline reconstruction and user activity analysis.
Registry Forensics on Linux: RegEdLin vs RegistrySpy
Windows registry forensics on Linux is now accessible via tools like RegistrySpy and RegEdLin, both capable of viewing registry hives outside a Windows environment. RegEdLin offers a dual-column view for comparing two separate hives simultaneously, a feature useful for side-by-side artifact analysis.
Industry News
Survey Reveals Public Sector Digital Investigation Barriers
A new survey of more than 300 public sector professionals identifies growing obstacles in digital investigations, including evidence access gaps, fragmented case handoffs, and eroding trust in AI-generated findings. The Public Sector Digital Investigations 2027 Report maps these pressures and their implications for how agencies handle digital evidence.
Read more (magnetforensics.com)
Training & Events
New Browser Forensics Course Launches
A new browser forensics training course aimed at DFIR practitioners is now available, developed in collaboration with industry professionals. Covering artifact analysis and investigative methodology, the course targets examiners who want to extract maximum investigative value from web browser evidence.
