A round-up of today’s digital forensics news and views:
Tools & Software
Open-Source Toolkit Targets Compromised Edge Device Forensics
A free, open-source Edge DFIR Toolkit now covers forensic investigation of 10 network edge platforms including FortiOS, Ivanti Connect Secure, PAN-OS, and NetScaler. It catalogs 92 artifacts with volatility-ordered, read-only collection plans, 142 detections with Sigma and YARA rules, and per-CVE exploitation timelines. Response playbooks open with explicit “do not” lists to prevent evidence destruction on devices that cannot be imaged or agented.
ALEAPP Adds KeepSafe Android Artifact Parser
A new ALEAPP module now parses artifacts from the KeepSafe Android vault app, recovering data that most forensic tools overlook. Some KeepSafe files retain EXIF metadata including original creation dates and GPS coordinates, extractable via ExifTool even when automated parsers miss it. Examiners are urged to inspect underlying files directly rather than relying solely on tool output.
Legal & Policy
Documenting AI in Forensic Reports for Court
Examiners who rely on AI-assisted tools without documenting them risk undermining their findings in court, particularly when opposing counsel can exploit the gap between collection-era capabilities and trial-era technology. SANS VP Heather Barnhart outlines documentation standards distinguishing built-in forensic AI from general-purpose models, and maps guidance to SWGDE standards and NIST CSF 2.0. Human examiners retain final authority at every phase.
Research & Techniques
AI Transcription Errors Pose Courtroom Evidence Risks
AI transcription tools like OpenAI’s Whisper can dramatically cut processing time, as New Zealand Police demonstrated when 750 hours of manual review was reduced to 10, but a 2024 study found roughly 1% of Whisper transcriptions contained hallucinated content. A Nova Scotia Court of Appeal case shows the stakes: fabricated certifications in AI-generated transcripts cost an appellant $20,000 in costs. Digital forensic examiners must distinguish between verifying a document’s authenticity and confirming its accuracy as a record of what was actually said.
Read more (alphafoxforensics.com)
Training & Events
uLEAPP Linux Version Walkthrough for DFIR
uLEAPP, a cross-platform manager for the LEAPP suite of forensic parsers, now runs at version 0.3.15 following a recent update by developer Michael Littrell. The Linux version differs enough from its Windows counterpart to warrant a dedicated walkthrough, covering installation, updates, and launching tools including iLEAPP and ALEAPP from a single interface.
