A round-up of today’s digital forensics news and views:
Legal & Policy
Europol Maps EU Digital Forensics Capability Gaps
Europol and the European Commission have published a comprehensive gap and needs analysis of digital forensic capabilities across EU Member States, identifying shortfalls in cloud, IoT, and vehicle forensics. Standardisation, AI compliance, and training deficits among first responders and legal professionals are flagged as priority areas, with recommendations to strengthen EU-wide forensic capacity.
Research & Techniques
ORISA Tool Recovers Deleted AI Chats from Android Memory
Georgia Tech researchers have built ORISA, a memory forensics tool that recovers deleted conversations from locally running AI assistants on Android devices, even after users delete them. Tested across 10 apps, three AI models, and 60 configurations, the tool reconstructs recoverable fragments into functional AI sessions, surfacing data the original session had already stopped actively using. Presented at the 2026 IEEE Symposium on Security and Privacy, the research opens a new artifact category for mobile forensic examiners investigating AI assistant activity.
iOS Unified Log Terms That Mislead Examiners
A structured cheatsheet for Apple Unified Log analysis identifies common search terms that return misleading results, grouping them by misinterpretation type: terms with dual meanings, single lines with multiple causes, and absent results that are not true negatives. For example, tapToWake appears in ProximitySensor as a mode label, a single edge-touch line is not a swipe, and zero hits on HIDEvent Power terms reflect version changes in iOS 18.2.1 and 26, not absence of events. Examiners are advised to rank each line by what it can prove, corroborate with a second line from a different process, and record device model, build, and acquisition method for every search.
KQL Hunting Queries Target Azure Key Vault Logs
Researcher Bert-Jan Pals has documented the undocumented CloudKeyVaultEvents table in Microsoft Defender Advanced Hunting, mapping its full schema after finding no public documentation or Google results for it. Testing across multiple tenants confirmed the table is populated only when Microsoft Defender for Key Vault is enabled, at $0.25 per vault per month. KQL hunting queries cover risky sign-in followed by Key Vault access, suspicious enumeration, and incident response enrichment of service principal and user activity.
Tools & Software
UFADE and ALEX Mobile Forensic Tools Updated
UFADE 1.0.5 adds support for the latest Apple devices, backports userspace tunneling for iOS 17.4+ without elevated privileges, and fixes full filesystem extraction issues. ALEX 0.7 gains CVE-2016-10277 and Dirty COW exploit support for older Android devices, plus offline ADB backup decryption and improved SU manager detection.
Open-Source Toolkit Targets AI Infrastructure Forensics
Raymond DePalma’s ai-dfir-toolkit provides vendor-neutral Sigma, YARA, and Suricata rules for investigating compromised LLM applications, MCP servers, and RAG/vector databases. Prompt and completion logging is off by default in three-quarters of AI systems, meaning critical investigative data may never exist on disk. Examiners should audit token scopes and purge compromised agents fully before any redeployment.
Industry News
AOMEI Backupper Update Servers Served Backdoor
Attackers modified two unsigned configuration files on AOMEI’s own update servers during five-to-ten-minute windows between May and July 2026, causing any copy of AOMEI Backupper that checked for updates during those periods to silently download and execute a backdoor. A downloader named CROSSROAD installed a signed Radmin binary alongside a malicious DLL that loads the SHINYROAD implant, established a scheduled task named RadminComponentRuntime, then erased itself, leaving machines appearing clean. Affected organizations span 11 countries across IT services, telecoms, and higher education, and a server-side fix does not remove the implant from already-compromised hosts.
Forensic Focus Opens State of DFIR Survey
The Forensic Focus State of DFIR Survey is now open, covering caseloads, AI adoption and restrictions, AI-manipulated media in casework, skills gaps, and three-year career outlook. Anonymous responses take around eight minutes, and participants can request early access to the report ahead of its January publication. The survey closes 30 November.
Case Studies
Forensic Analysis of Digispark HID Attack Device
During a real incident investigation, NVISO researchers recovered a Digispark Rev.3 configured as a rogue USB keyboard, executing malicious PowerShell payloads within seconds of insertion. Because the payload resides on the ATtiny85 microcontroller rather than removable storage, standard file review is insufficient, requiring firmware extraction and host-based artefact correlation. Researchers document a safe, repeatable analysis workflow covering device programming, behavioural testing, and firmware readout using low-cost hardware.
Live Implant Rewrites Next.js for Persistent Access
Attackers exploited CVE-2025-55182, a CVSS 10.0 unauthenticated RCE in React Server Components, and deployed a remote-control agent within 36 seconds on a deception host. Three persistence mechanisms kept the implant alive: a cron job, a shell watchdog polling /proc every 15 seconds, and a one-line require() hook prepended to Next.js server files so the agent relaunches on every application restart. A routine cleanup that kills the agent and removes its directory leaves the boot hook intact inside node_modules, along with IOCs including a credential harvester and XMRig miner.
Read more (countercraftsec.com)
Training & Events
SANS FOR563 Trains DFIR Pros on Local LLMs
A one-day SANS course, FOR563, teaches DFIR practitioners to run local LLMs against forensic artifacts including logs, JSON, mobile data, and binary config files without exposing case data to third-party services. Mari DeGrazia, Director of DFIR at IDX, leads four hands-on labs covering forensic agent builds, plain-language artifact queries, and an introduction to fine-tuning on practitioner datasets. The course runs October 30th in San Francisco, costs $995, and awards 6 CPEs.
