Forensic Focus

Articles

19th October 2026

Investigating WMI Permanent Event Subscription Persistence

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Today's headlines 19 Oct 2026

More news →

News

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

News

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

News

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Register For Webinar: Best Strategies for Remote Collections of Computer, Mobile and Cloud Data

1st October 2020

With coronavirus uncertainties and outbreaks still prevalent, and no end in sight, businesses’ continue to put their employees health and safety first by supporting work at home initiatives. This has prompted companies like yours to implement mobile remote technologies to

Success Or Failure In A Murder Case Can Depend On Deleted Text Messages

5th October 20201st October 2020

If you have been obsessed with true crime TV series or have watched police procedural shows, there’s a good chance you’ve seen dramatic depictions of a mobile forensic investigation. Usually we see an investigator examining the phone then clicking some

Nuix Investigate Power User Webinar

1st October 2020

Charles: Hello everyone. Thank you for joining us for the Nuix Investigate power user webinar. My name is Charles Klein. I am product manager for Nuix Investigate, and I am joined today with my colleague Gareth Bernard, who is one

How To Expose Evidence Of Timestomping In Magnet AXIOM 4.4

30th September 2020

Hey everyone, Tarah Melton here, and today I’m going to show you a new artifact that you can enable in AXIOM 4.4 when processing a Windows evidence item, called NTFS Timestamp Mismatch. This artifact is looking for a couple of

Samsung Exynos Support In Oxygen Forensic Detective

29th September 2020

Oxygen Forensic® Detective 13.0 has introduced the ability to bypass screen locks, perform physical acquisitions, and decrypt data from Samsung devices based on Exynos chipsets. The main obstacle to the data extraction from Samsung devices is that the user data

How To Use And Export Cloud Tokens With XRY

29th September 2020

In this video, I’m going to show you how to download cloud tokens with XRY. This does require the XRY Cloud license to download them. You don’t get them without that license – as you can see here, I did

Forensic Focus Legal Update September 2020: Evidence, Experts, And Due Diligence

22nd February 202328th September 2020

The COVID-19 pandemic slowed many of the gears in justice systems the world over, as courts postponed jury trials, experimented with virtual juries and hearings, and weighed prison conditions against public safety. But not even the passing of venerable United

Amped Replay 18163 Now Available With New Assisted Tracking And More Video File Formats

28th September 202028th September 2020

Amped Software has released another update to Amped Replay, a forensic DVR/CCTV converter and player for investigators. With update 18163, users get new assisted tracking for automatic spotlighting and redaction, plus more supported video formats, and now also available in

On Demand Webinar: So Many Logs, So Little Time: Efficient Windows Event Log Analysis

28th September 2020

Windows Event Logs record evidence of many significant types of activity, including when a machine was booted or shut down, when users logged in and out and from where, device insertions, network connections and so much more. But knowing how

DFRWS Virtual USA 2020: Recap

25th September 202025th September 2020

In July, digital forensics professionals from the public, private, and academic sectors came together to hear about some of the latest research in the industry. In his opening remarks, DFRWS USA Conference Chair Josiah Dykstra, a Technical Fellow with the

AFF4-L Support, Portable Case Updates and More in Magnet AXIOM 4.5 & Magnet AXIOM Cyber 4.5

23rd September 2020

Magnet AXIOM 4.5 and Magnet AXIOM Cyber 4.5 are now available! With AXIOM 4.5 and AXIOM Cyber 4.5, search performance improvements have been made to speed up investigations and Portable Case has been updated so it’s easier to share case

Oxygen Forensic Detective 13.0 Offers Samsung Exynos Dump And OCR Section