A round-up of today’s digital forensics news and views:
Forensic Focus News
Preparing Digital Multimedia Evidence For Court: What To Consider Before Presentation
Presenting digital multimedia evidence effectively in court requires decisions about format, compatibility, and context well before trial begins. Surveillance footage often needs conversion from proprietary formats, aspect ratio correction, and interlacing fixes to display reliably on courtroom equipment. Annotations, redaction, viewing logs, and comparative illustrations are all tools available to practitioners, with every processing step automatically documented for disclosure.
Explore Cellebrite’s Autumn 2026 Release: Discover What’s New
Cellebrite’s Autumn 2026 release spans three capability areas: field and lab evidence access via Inseyets, AI-driven investigation support through the Genesis agentic platform, and case collaboration tools in Guardian and Pathfinder. Genesis surfaces connections, timelines and leads across evidence in minutes, and is available as a free trial without requiring an existing Cellebrite subscription.
Research & Techniques
Plaso Plugin Allows False Timeline Entry Injection
A vulnerability in Plaso’s GoogleAnalyticsUtmzPlugin allowed malicious websites to overwrite tool-assigned timeline metadata fields, including data_type and parser, by crafting __utmz cookie values. A forged cookie could make a Firefox cookie entry appear as Chrome browser history or a file system stat event, misleading analysts and automated tooling. Remaining indicators include the pathspec pointing to the cookie database and an accompanying cookie entry for the originating host.
Read more (osdfir.blogspot.com)
ChatGPT IDs Contain Extractable Forensic Timestamps
ChatGPT conversation or object IDs contain embedded timestamps that can be extracted during forensic investigations, adding a new artifact type for DFIR examiners. Tooling via Unfurl appears to support parsing these identifiers, giving practitioners a practical method to recover temporal metadata from ChatGPT-related evidence.
iOS Biome SEGB File Format Explained for Examiners
iOS Biome stores device-activity data in SEGB files under /private/var/mobile/Library/Biome/streams/restricted, with two distinct versions: v1 places the SEGB magic bytes at offset 52, while v2 (iOS 17+) leads with the magic and adds a reverse-ordered trailer tracking entry state and Cocoa timestamps. Entries marked deleted may still contain recoverable data and should be parsed and reported with their state noted.
Read more (learn.hexordia.com)
Forensic Framework Fingerprints Hacked Medical Devices
A new Multimodal Behavioral Fingerprinting Framework fuses network traffic metrics with physiological payload data to forensically attribute data-alteration attacks on connected medical devices after an incident. Validated on the WUSTL-EHMS-2020 IoMT dataset, the Random Forest classifier achieved an F1-score of 0.99 for detecting altered biometric payloads that evade conventional network-only detection.
Incident Response
Claude Code VS Code Extension Drops SSH Backdoor
A backdoored version of the official Claude Code VS Code extension on Open VSX installs a persistent SSH backdoor across macOS, Linux, and Windows by injecting a malicious IIFE into the extension bundle. Attackers plant an Ed25519 public key in ~/.ssh/authorized_keys and establish an outbound reverse tunnel to 134.209.82[.]225, though a macOS privilege-check bug breaks the SSH enablement step on most standard user accounts. Anthropic has pulled version 2.1.313 from Open VSX, npm, and the VS Code Marketplace, and incident responders should audit environments for the svc-telemetry key comment and related persistence artifacts.
Tools & Software
Plaso 20261027 Adds ESXi and HTTP.sys Parsers
Plaso 20261027 brings new parsers for ESXi logs and Microsoft HTTP.sys error logs, alongside extended syslog support covering sudo, cron, and modern OpenSSH formats. Significant bug fixes land for Firefox, Chrome, Safari, Skype, and NTFS $MFT parsing, and performance improvements accelerate event tagging and output across the board.
Read more (osdfir.blogspot.com)
Training & Events
BitLocker TPM Sniffing Course Wraps for 2026
Investigators from Alaska and the UK completed a three-day hands-on course covering hardware exploitation, TPM sniffing, and BitLocker key extraction, skills that can unlock evidence otherwise inaccessible to examiners. Participants travelled significant distances to attend, reflecting a recognised capability gap in forensic access to encrypted drives. Next sessions are scheduled for 2027, with on-site delivery available globally.
IACIS Scholarship Opens for Women in DFIR
IACIS is accepting applications from October 1 to November 30 for a scholarship open to women working in law enforcement, both sworn and civilian. Sponsors include Root Forensics LLC, SUMURI, and Arsenal Recon, reflecting broad DFIR community support for workforce diversity.
