A round-up of today’s digital forensics news and views:
Forensic Focus News
Agentic AI For Digital Investigations: Matt Goeckel Introduces Cellebrite Genesis
Matt Goeckel, a former law enforcement detective turned Cellebrite technical marketer, joins the Forensic Focus Podcast to discuss agentic AI in digital investigations and Cellebrite Genesis. Goeckel’s career path from standing up a mobile forensics lab in North Central Florida to Cellebrite’s marketing team shapes his perspective on making complex forensic technology accessible to practitioners.
End-To-End Digital Investigations: From First Access To Final Verdict
Digital forensic labs face growing backlogs as device storage hits 1 TB while team sizes stay flat, and siloed tools force non-technical reviewers to navigate multiple platforms. Magnet Forensics addresses this through an integrated stack spanning GrayKey, GrayKey Fastrak, AXIOM, Magnet Review, Griffeye, and Magnet Witness, unified under Magnet One. The workflow runs from mobile extraction through cloud evidence processing to court-ready reporting.
Magnet Forensics Launches Magnet AI Research Lab To Provide Peer-Backed Evidence To The Community
Magnet Forensics has launched the Magnet AI Research Lab, a program dedicated to producing peer-reviewed research on AI in digital forensics. Its first published study, appearing in the Journal of Forensic Sciences, tested the AI expert system in Magnet Verify against 20 trained human examiners across 14 video files, finding the system achieved 91% accuracy versus a 69% human average with zero incorrect classifications.
Research & Techniques
Reverse Engineering Reveals Windows EDR Kernel Exit Plan
Microsoft is developing the Windows Endpoint Security Platform to move EDR products out of the kernel following the July 2024 CrowdStrike outage that crashed 8.5 million machines. Preview binaries wesp.sys and espclient.dll already ship in Windows Insider builds, and reverse engineering via public symbols reveals wesp.sys operates as a file system mini-filter at altitude 329500, communicating with user mode over a filter communication port. Critically, current binary analysis shows no mechanism allowing user-mode clients to block process creation, a capability EDR vendors depend on.
ORISA Tool Recovers Deleted On-Device AI Chats
Researchers at Georgia Tech have developed ORISA, a digital forensics tool that recovers deleted conversations from locally running AI applications on Android phones by searching device memory for residual data fragments. Tested across 60 experiments involving 10 Android apps and three AI models, ORISA reconstructed more conversation data than the model itself had available at the time of deletion. Investigators could use the tool to reconstruct AI chatbot sessions, provided they have access to a memory image of the target device.
RDP Artifacts Reveal Lateral Movement and Session Detail
Windows RDP sessions leave forensic traces on both the client and server that go well beyond simple connection logs. Jeff Rutherford’s technical breakdown covers who connected, session interactivity, timing, and activity reconstruction, with lateral movement detection built into the methodology. Correlating RDP evidence with execution, filesystem, network, and authentication artifacts builds a richer investigative timeline.
Read more (magnetforensics.com)
LevelDB Structure and Acquisition for DFIR Examiners
LevelDB is a folder-based database format common in Chromium, Electron, and Google apps on Android and macOS, making it a frequent artifact in mobile forensic examinations. Examiners who collect only .ldb files risk missing the newest writes stored in the .log file, which captures the most recent appended data. The CURRENT file names the active MANIFEST, which in turn indexes .ldb table files and their key ranges.
Read more (learn.hexordia.com)
Linux Software RAID Superblock Structure Documented
A forensic researcher has published detailed documentation on Linux software RAID superblock metadata, examining on-disk structures encountered during work on mtt.sh. Understanding RAID superblock layout is directly relevant to examiners acquiring or reconstructing Linux RAID volumes during investigations.
Tools & Software
Velociraptor Artifact Hunts PHP2Shell Exploitation
A new Velociraptor artifact, Generic.Detection.Yara.PHP2Shell, applies YARA rules to web server, PHP, WAF, and container logs to detect exploitation of PHP2Shell CVEs across four attack chain stages. Rules are derived from confirmed in-the-wild honeypot data and public proof-of-concept exploits, covering heap pressure uploads, session ID leakage, and shell execution artifacts. Output maps each matched log line to a severity-rated rule, enabling analysts to correlate attacker activity by client IP and timestamp.
Read more (docs.velociraptor.app)
MCPTrace Carves MCP Artifacts from Memory Dumps
MCPTrace is an open-source Volatility 3 plugin that extracts Model Context Protocol and JSON-RPC message candidates from Windows and Linux memory images. It recovers tool names, call arguments, request-response pairs, virtual addresses, and SHA-256 hashes while preserving original bytes for verification. Results export as JSONL for further analysis without requiring any external AI API.
GLEAPP Adds C2PA Provenance and Regional Hash Schemes
GLEAPP v2026.5.6 adds Content Credentials (C2PA) parsing, flagging files that declare generative AI origins via CR and AI badges in tiles, filters, HTML reports, and LAVA artifacts. Regional Project VIC category schemes now cover 17 jurisdictions, including Europol, letting each case retain the scheme under which it was created for consistent hash matching and reporting.
