Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 19 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Passware Kit Forensic 2020 From Passware

Encryption, passwords, pass codes and other security measures are seemingly the ever-moving target in digital forensics. Whether your investigative focus is mobile devices and trying to bypass or obtain the pass code to collect valuable phone/tablet data; computer systems involved

Shahar Tal, VP Research, Cellebrite

Shahar, tell us about yourself, your role as VP Research, and Cellebrite’s Security Research Labs. I have the outstanding honor to work with one of the most brilliant teams in our profession. I lead Cellebrite’s Security Research Labs, which are

Upgraded XRY 9.2.1 And XAMN 5.2.1 Now Available

Greater Checkm8 extraction support for iOS, improved decoding of Warrant returns and much more. Today’s XRY 9.2.1 and XAMN 5.2.1 releases arrive with across the board improvements. Release highlights: The XRY integrated jailbreak tool, based on the checkm8 exploit, now

Fighting Child Exploitation With Digital Forensics

Why it matters Who will listen to the hundreds, if not thousands, of silent children who cry out for justice after being victims of manipulators or authority figures? You would think that the answer to the question “why does it

Automated Control Logic Forensics In Industrial Control Systems

Upon reading the title, the first few questions that might come to a reader’s mind are: what are Industrial Control Systems? Why are they important? How can an attacker attack them? What is control logic, engineering software, etc.? How does

25 Days, 25 Questions: Part 4 – Lab And Tool Standards

Editor’s note: This article concludes our four-part series written by Mr. Santosh Khadsare, our guest digital forensics expert from New Delhi, India, based upon his recent LinkedIn series, #25Days25Questions. More about Mr. Khadsare is in his bio below. On 18

VFC 5.2 And VFC Mount

Virtual Forensic Computing (VFC) was first launched to the digital forensic community in 2007. It is the original and still the go to virtualisation solution for the digital forensic investigator. VFC makes it easy to create a Virtual Machine (VM)

Managing Mountains Of Evidence

One truism about digital forensics is that every case is different.  As the technology has evolved, we have had to come up with new and inventive ways to problem-solve and work around issues in both the mobile and computer forensic