A round-up of today’s digital forensics news and views:
Forensic Focus News
Roadblocks Ahead! Navigating The Major Issues Of Mobile Forensics
Christopher Vance, Staff Technical Forensics Specialist at Magnet Forensics, draws on input from examiners across the field to identify the most persistent challenges in mobile forensics today. Device state preservation tops the list, with proper isolation, AFU access, and field-to-lab communication gaps all contributing to evidence loss before examination begins. Simple measures like laminated checklists in Faraday bags and vendor preservation modes can close some of those gaps.
Belkasoft Releases Belkasoft X v2.12, Adding Offline Translation And AI-Assisted Database Analysis
Belkasoft X v2.12 introduces offline evidence translation via BelkaGPT, supporting over 200 source languages with all processing kept local to the forensic environment. BelkaGPT can now classify SQLite databases by content type, including communications, location, and financial data, while custom artifact mapping brings unrecognised databases into standard review workflows. New Android, iOS, and Windows parsers expand artifact coverage, and a redesigned MediaTek acquisition workflow separates acquisition from decryption for damaged or non-booting devices.
Green Meets Blue: A Brief RCS Forensic Excursion
RCS (Rich Communication Services) is the IP-based successor to SMS and MMS, now supported on modern Android devices and iPhones running iOS 18 or later, as well as by major carriers including AT&T, Verizon and Vodafone. MSAB digital forensics specialist Markus Hess breaks down how RCS differs from SMS and iMessage, covering encryption, feature support and cross-platform behaviour. Forensic practitioners will find guidance on where RCS evidence is stored and what artefacts are recoverable from standard messaging apps.
Research & Techniques
Steam Frame DFIR Artifacts: First Look
A DFIR researcher has begun investigating the Steam Frame, confirming it is readily accessible via SSH, ADB, and RDP, with the default account holding sudo privileges. These access vectors and elevated permissions have significant implications for forensic acquisition and evidence integrity on the device.
Industry News
Oxygen Forensics Under Scrutiny Across Europe
London’s Metropolitan Police has suspended its contract with Oxygen Forensics amid a US Justice Department case alleging the Virginia-headquartered company concealed Russian ownership and FSB-linked development ties. Oxygen’s Forensic Detective tool had been used by law enforcement across Germany, Spain, Italy, Poland, Hungary, Romania and Latvia, and featured in at least two EU-funded digital evidence projects. Romania’s National Anticorruption Directorate has since announced it will discontinue Oxygen products entirely.
Tools & Software
Fuji Open-Source Mac Acquisition Tool Highlighted
Fuji, a free open-source forensic acquisition tool for macOS, uses native Apple commands shipped on every modern Mac to support exigent acquisition workflows. A Recovery Mode feature added earlier this year expanded options for teams unable to justify commercial tools. Developer Andrea Lazzarotto has supported community adoption through direct engagement with practitioners.
