News

Mark Scanlon discusses his student's research at DFRWS EU 2019. OK, good morning, how are you doing? My name is Mark Scanlon, I’ve been speaking to some of you guys already. I’m from University College Dublin. This work was primarily

Have you ever served a search warrant and stared at the mountainous amount of digital media collected and wondered how much is actually related to your investigation? Or, have you had to undertake terabytes of storage media and wondered if

The problem that has been plaguing investigators is the fact Android devices offer different mechanisms of data protection. For this reason, it is almost impossible to develop a single method of extracting and decrypting a device’s data. Of course, in

Errata Security discuss how to decrypt WhatsApp end-to-end media files. The HTCIA 2020 call for presentations is now open. Linux Security Labs share a review of GRR Rapid Response. Rick Holland recaps the SANS Cyber Threat Intelligence Summit 2020.

Amped Software just released another update to Amped Authenticate, the leading forensic software for digital forensic experts to exploit the data behind digital images, allowing analysis of image integrity, authenticity, metadata, source and history, and detection of tampering prior to

Andrea Fortuna shares some thoughts on the Jeff Bezos phone hack data. Ciarán O’Brien provides a triage script to help with retrieving artifacts from compromised Citrix hosts. Magnet discuss how their new AXIOM Cyber tool can help with employee misconduct

Adam Harrison discusses evidence of program execution on different Windows OS versions. Magnet release AXIOM Cyber for remote acquisitions. Foxton Forensics discover some differences between Chromium and Edge Chromium artifacts. Andrew Hoog unpicks NavdDoomConductor, which tracks precise geolocation and time

Magnet Forensics is proud to announce the official release of their newest product: Magnet AXIOM Cyber. AXIOM Cyber is an innovative new solution purpose-built for organizations that need to perform remote acquisitions as well as collect and analyze evidence from

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss IPv6 to IPv4 conversion in response to a warrant request. Can you explain why this prefetch folder is empty? How would you respond to

Steve Anson’s new book, Applied Incident Response, is now available on Amazon. Ciarán O’Brien has been working on a Jupyter notebook to help automate the process of pulling IOCs from artifacts recovered from compromised Citrix Netscalers. Heather Mahalik instigates a

by Christa Miller Only a few short years ago, the idea of recovering forensic data from the cloud seemed like either troubling overreach, or unnecessarily redundant given the availability of evidence from mobile devices. As encryption became more prevalent on

Ryan Benson shows how Google search URLs can be a great source of digital forensic information. Magnet’s Jamie McQuaid discusses how deduplication can help your forensic analysis. Paraben’s Amber Schroader talks about getting started in digital forensics. Cellebrite share a

Jan Peter van Zandwijk discusses his research at DFRWS EU 2019. Hello, my name is Jen Peter van Zandwijk. I work with the Netherlands Forensic Institute. And in this half-hour I will tell you about some research that they did

DFRWS announce a Women in Forensic Computing Workshop and Digital Forensics Bootcamp as part of this year’s EU conference. Mattia Epifani presents the CASE Ontology to the European Commission in Brussels. Mike Art Rebultan shares his route to a DFIR

by Jade James AccessData Enterprise enables investigators to forensically image and analyse devices. It also provides a means of workflow analysis and documentation, as well as a level of staff management. The inclusion of FTK means that examiners can conduct

Jessica Hyde shares a list of resources to help you keep up-to-date with mobile forensics. 13Cubed talk about CVEs in Windows event logs. Belkasoft discuss what’s new in Belkasoft Evidence Center v9.9.