A round-up of today’s digital forensics news and views:
Forensic Focus News
Genesis Momentum Powers Cellebrite’s Autumn Release: More Evidence, Deeper Insight, Broader Access For Investigations
Cellebrite’s Autumn 2026 Release centres on Genesis, its agentic AI solution, which has surfaced confessions in homicide cases, identified suspects across 400 hours of doorbell footage, and linked financial transactions to new investigative leads. The release also adds expanded iOS and Android device support, DJI drone forensics, CDR analysis in Pathfinder, and a ruggedized field kit for military teams. An on-premises Genesis version is planned for early 2027.
Case Studies
Three Labs Document Serbian Spyware Operation
Citizen Lab, Amnesty International’s Security Lab, and the SHARE Foundation have jointly confirmed Serbian intelligence deployed Pegasus spyware, Cellebrite extraction hardware, and a custom Android implant called NoviSpy against at least 15 targets during Serbia’s 2026 election cycle. Confirmed infections include a university rector’s iPhone compromised via zero-click iMessage exploit and an anti-corruption prosecutor flagged by Apple threat notifications. Researchers describe the operation as the most extensively corroborated mercenary spyware campaign documented in a European democratic election.
Tools & Software
crush-forensics v0.24.0 Improves Artifact Parsing
crush-forensics v0.24.0 and v0.23.0 bring accuracy improvements to LevelDB, SQLite WAL, and NSKeyedArchiver reading, along with Protobuf visualisation as a tree in the BLOB Inspector. Exports now list failed items, aiding triage, and the tool ships its first localisation with German language support.
Research & Techniques
XRY Pro Test Point Extraction on MediaTek Devices
Physical extraction via test point is a key technique for mobile forensic examiners facing locked MediaTek devices. Grounding the test point places the chipset into boot ROM mode, allowing XRY Pro to attempt PIN brute-force and full memory acquisition.
Search Terms That Mislead Forensic Examiners
Misreading a forensic artifact often stems from not understanding why it was created, not just that it exists. Tim Korver’s thesis examines how search terms can produce misleading hits, and why tracing the root cause of an artifact is essential to accurate forensic interpretation.
Training & Events
SANS DFIR Summit 2026 Covers Cloud, Mobile Artifacts
Anti-forensics techniques, cloud log retention gaps across AWS, Azure, GCP, and M365, and low-level Apple Unified Log parsing were among the technical highlights at the 2026 SANS DFIR Summit in Arlington, VA. A hands-on Velociraptor workshop had attendees building custom artifact parsers and tracing attacker activity across seven machines simultaneously, while a dedicated session broke down OneDrive sync databases forensic examiners can extract metadata from.
Cyber Triage Releases Ultimate DFIR Training Collection
Cyber Triage has published a comprehensive collection of DFIR training resources spanning introductory concepts, Windows Registry forensics, jump list analysis, RMM tool investigations, and AI integration for incident response. Topics range from artifact-level guides on AmCache, Shellbags, and UserAssist to technique breakdowns covering Kerberoasting, Mimikatz, and Certutil abuse. Tool comparison guides and buyer resources round out the collection.
Hexordia Course Teaches Manual Data Structure Parsing
Hexordia’s Data Structures Course, created by Jessica Hyde and Kim Gatson, is now available on demand, covering eight formats including SQLite, Plist, Protobuf, LevelDB, ABX, and SEGB across 74 video lessons. Examiners learn to identify formats from raw bytes, manually read records when tools fall short, and verify tool output against source data. All tools used are open-source or freeware, and the course awards a certificate on completion.
Read more (learn.hexordia.com)
Webinar Explores Mobile Health Data Forensics
Health data stored on iOS and Android devices can yield significant investigative value, but its accessibility depends on the level of extraction achieved. Magnet Forensics examiner Christopher Vance will cover how health data is protected on each platform and what artifacts investigators can realistically recover across different acquisition methods.
