7th August 2025

The Balance Between Digital Forensic Examiners And Digital Evidence Technicians: Expertise Vs. Efficiency
Hero Image

Can digital forensic labs cut backlogs without cutting corners? Debbie Garner explores how tiered workflows using both examiners and technicians can strike the right balance....

Read More
Forensic Focus Digest, August 08 2025

Forensic Focus Digest, August 08 2025

8th August 2025

Discover what’s new on Forensic Focus – explore the balance between expertise and efficiency in digital forensics, tackle the challenges of multi-jurisdictional investigations, and learn how transforming organisational culture can improve mental health in the field....read more

More Than Software: Amped Training Teaches You The Science Of Forensic Video And Image Analysis

More Than Software: Amped Training Teaches You The Science Of Forensic Video And Image Analysis

7th August 2025

Push past button-clicking—Amped Software training teaches the science behind forensic video analysis....read more

Digital Forensics Round-Up, August 06 2025

Digital Forensics Round-Up, August 06 2025

6th August 2025

Read the latest DFIR news – starting a digital forensic business, Hashcat v7.0.0, GenAI incident response guidance, cross-border investigation challenges, and more....read more

How To Conduct A Live Forensic Scan Of A Windows Computer

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator. Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the

How To Conduct A Live Forensic Scan Of A Windows Computer

Learn how to conduct a Windows live scan with ADF Solutions Digital Evidence Investigator.  Two USB ports are required to complete a scan, one for the Collection Key and one for the Authentication Key, once the scan has started the Authentication

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members advise on producing E01 images in reverse sector order. How would you convert an AD1 image to a dd? Can you help roncfluey to image

How To Use The Griffeye Intelligence Database

Beginning with version 19, Griffeye Analyze DI Pro and Core will start using the new Griffeye Intelligence Database, or GID, to replace the legacy intelligence manager. In this video, we’re going to discuss the changes that the GID brings to

How To Use The Griffeye Intelligence Database

Beginning with version 19, Griffeye Analyze DI Pro and Core will start using the new Griffeye Intelligence Database, or GID, to replace the legacy intelligence manager. In this video, we’re going to discuss the changes that the GID brings to

Hunting For Attackers’ Tactics And Techniques With Prefetch Files

by Oleg Skulkin Windows Prefetch files were introduced in Windows XP, and since that time they have helped digital forensics analysts and incident responders to find evidence of execution. These files are stored under %SystemRoot%\Prefetch, and are designed to speed

How To Decrypt BitLocker Volumes With Passware

Decrypting BitLocker volumes or images is challenging due to the various encryption options offered by BitLocker that require different information for decryption. This article explains BitLocker protectors and talks about the best ways to get the data decrypted, even for

Hunting For Attackers’ Tactics And Techniques With Prefetch Files

by Oleg Skulkin Windows Prefetch files were introduced in Windows XP, and since that time they have helped digital forensics analysts and incident responders to find evidence of execution.  These files are stored under %SystemRoot%\Prefetch, and are designed to speed

How To Decrypt BitLocker Volumes With Passware

Decrypting BitLocker volumes or images is challenging due to the various encryption options offered by BitLocker that require different information for decryption. This article explains BitLocker protectors and talks about the best ways to get the data decrypted, even for

What’s Happening In Forensics – Nov 20, 2019

Oleg Afonin talks about the forensic analysis of Synology NAS devices. Alexis Brignoni shares a realm database storage primer for digital forensic examiners. Amped show how to resize images with Amped Replay. Passware announce a new partnership with BlackBag. OpenText

How To Use Magnet AXIOM In Mac USB Investigations

Hey everyone, Trey Amick from Magnet Forensics here. Today we’re talking about Mac USB investigations, and what happens when we’ve been alerted that a USB has been inserted into an end point. Different organisations handle USB policies differently. Some have

How To Use Magnet AXIOM In Mac USB Investigations

Hey everyone, Trey Amick from Magnet Forensics here. Today we’re talking about Mac USB investigations, and what happens when we’ve been alerted that a USB has been inserted into an end point. Different organisations handle USB policies differently. Some have

Can Your Investigation Interpret Emoji?

by Christa Miller, Forensic Focus Emoji are everywhere — including in your evidence. Used across private-messaging apps and email, social media, and even in passwords and account names, emoji are pictographic representations of objects, moods, and words. They’re a convenient