A round-up of today’s digital forensics news and views:
Forensic Focus News
Cyber Unpacked S3:E2 // IR Beyond Malware: Investigating Business Email Compromise And Fraud
Business email compromise remains one of the most financially damaging cyber threats, with IC3 estimating losses of $2.7 billion in a single year and an average incident cost of $129,000. Former FBI digital forensic examiner Jeff Rutherford and incident response veteran Doug Metz break down BEC attack phases, the forensic artifacts investigators should expect, and practical investigative steps. A live demonstration of Magnet Axiom Cyber shows how the tool supports BEC case work.
Belkasoft X v2.13 Arrives With Amplified BelkaGPT And MFT-Based File Recovery
Belkasoft X version 2.13 brings expanded BelkaGPT capabilities including document summarization, chain-of-thought answer display, and topic detection across emails and SMS. Deleted file recovery now leverages NTFS Master File Table records, including from volume shadow copies, while new artifact extraction covers Claude AI, Copilot, and ChatGPT on Android and iOS.
Case Studies
Field Guide: Investigating Remote IT Worker Scams
Remote IT worker scams involve fraudulent hires using false identities, laptop farms, and VPNs to gain legitimate organizational access, sometimes escalating to data theft or extortion. DFIR investigators must correlate HR, payroll, endpoint, login, and payment records across multiple teams to establish fraud and scope any insider activity. Key investigative steps include preserving evidence before revoking access and comparing shipping addresses, VPN exit nodes, and MFA enrollment locations against claimed residences.
Read more (magnetforensics.com)
Research & Techniques
Researchers Decrypt Windows Defender’s Hidden Forensic Database
Every Windows machine stores a SQLite database called mpenginedb.db that Microsoft Defender’s scanning engine uses to log file metadata, tamper protection states, MITRE ATT&CK technique hits, and ransomware tracking data covering roughly the last two weeks. Researchers at Protokol-7 reverse-engineered the RC4 encryption protecting it, showing the 256-byte key can be derived directly from the evidence file without the original DLL. Tables including AttributePersistContext and BackupProcessInfo yield artifacts correlatable with NTFS USN journal entries, process execution timelines, and DLL sideloading indicators.
Read more (protokol-7.github.io)
Training & Events
New Browser Forensics Course Targets Security Analysts
Hindsight Foundry has launched Browser Forensics for Security Analysts, a course built around real investigative questions practitioners face during active cases. It covers deep analysis of browser artifacts with a focus on supporting practical investigative work rather than theory alone.
Workshop Tackles macOS Forensic Collection Challenges
Mac forensic collections are growing more complex with each new Apple chip and OS release. A free Workshop Wednesday session on November 18 will compare free, paid, and open-source acquisition solutions, with Boulder County digital forensic examiner Matt Beers weighing the pros and cons of each approach.
Read more (monolithforensics.com)
Webinar: Forensic Processing of PST and OST Files
Recovering hidden artifacts from Microsoft PST and OST email archives is a critical skill in digital investigations, yet corruption and deleted items routinely challenge examiners. A free 30-minute webinar will cover native processing of these formats, recovery of recycling bin items, and techniques for handling data corruption in the world’s most common email archive types.
Read more (events.teams.microsoft.com)
Tools & Software
Velociraptor Artifact Hunts HTTP.sys Backdoors
A new Velociraptor artifact, Windows.Detection.HttpSysListeners, enumerates HTTP.sys request queues, their registered URLs, and owning processes to surface hidden backdoor listeners on Exchange servers. Built to hunt CerealNeuron, a .NET HttpListener implant documented by ESET, it flags IOC URLs, unexpected process owners on port 443, and PIDs visible to HTTP.sys but absent from the process list.
