A round-up of today’s digital forensics news and views:
VLEAPP Doubles Artifacts, Major LEAPP Updates
VLEAPP has grown from 103 to 202 artifacts on its main branch, adding support for Ford SYNC, GM OnStar, GM Bosch HMI, Nissan 08IT, BMW MGU, and SiriusXM infotainment systems. Companion tools DLEAPP, iLEAPP, and ALEAPP received 65, 11, and 9 new artifacts respectively, and raw images can now surface free space and deleted flash files as artifacts.
VESTIGEX Beta Launches as Free DFIR Platform
VESTIGEX is a new free Windows desktop platform for digital forensics and incident response, supporting disk image formats (E01, raw, VHDX, VMDK, DMG), KAPE collections, memory forensics via Volatility 3, and mobile acquisition over ADB and iPhone encrypted backups. Artifact analysis spans Windows, macOS, Linux and mobile sources, with a unified super-timeline, 2,400+ Sigma rules mapped to MITRE ATT&CK, and a local AI assistant powered by Ollama that keeps all evidence on-device. Currently in beta (v1.1.1), the tool generates hash-chained audit logs and chain-of-custody reports in HTML, PDF, Word and Excel.
Open-Source Tools Extract Files from NTFS Disk Images
Two open-source command-line tools, ntfsfind and ntfsdump, allow DFIR practitioners to search and extract files directly from Windows disk images without mounting them. Built on direct MFT parsing, ntfsfind supports regex path search with metadata filters including timestamps, file attributes, deleted entries, and ADS records, while ntfsdump recreates directory structures from dd, E01, VHD, VHDX, and VMDK formats including VMware snapshot chains and Hyper-V differencing disks.
Legal & Policy
SWGDE Finalizes Cell Site and RF Survey Guidelines
SWGDE has published two finalized, consensus-based documents covering historical cell site analysis and radio frequency propagation surveys, completing their public comment period. Developed by the Cellular & Geolocation Committee with input from federal, state, local, academic, and private sector experts, the guidelines offer a foundation for updating agency SOPs and technical workflows involving location and network data.
Research & Techniques
eBPF Rootkit Detection Artifacts Examined
eBPF rootkits can hide processes and forge privileges without touching the syscall table, bypassing traditional LKM-based detectors entirely. Detection pivots to monitoring the bpf() syscall, loaded-program enumeration via BPF state, and eBPF helper functions like bpf_probe_write_user rather than kernel symbol comparisons.
Windows Event Log Analysis Guide for IR
A detailed incident response guide covers Windows Event Log investigation methodology, from evidence preservation and scoping to key Event IDs for logon analysis, lateral movement detection, and Kerberos/NTLM authentication tracing. Logon Type definitions, failure reason codes, and RDP session artifacts are mapped to specific event channels, giving practitioners a structured starting point for triage. Guidance on AI-assisted analysis includes clear warnings about hallucination risks and data privacy when handling sensitive log content.
Linux RAID UUID Byte Order Trips DFIR Analysts
Linux Software RAID stores UUIDs in little-endian byte order in the on-disk superblock, but the /run/mdadm/map file records active volume UUIDs in big-endian format. Examiners correlating RAID metadata across these two sources may incorrectly conclude UUIDs do not match without accounting for the byte-order reversal.
iOS Tinder Artifacts Mapped for Forensic Examiners
Tinder’s local iOS SQLite database links match records, messages, and cached user profiles in a single source, giving examiners a pathway to reconstruct interactions chronologically. Key artifacts include match timestamps, message drafts, Super Like indicators, approximate distances, and linked Instagram details, all stored at a documented container path.
