Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 19 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Case Study: Digital Evidence Confirms Players In Major Bitcoin Heist

Traditional policework helped track down the thieves targeting cryptocurrency data centers in Iceland, but digital intelligence from one suspect’s mobile devices provided the proof of their involvement. Date: 2018Challenge: To connect six suspects to the theft of more than $2M

Digital Forensic Evidence And Artifacts: Recent News And Research

This month’s academic research reflects two aspects of the changing digital forensics industry: new ways to think not just about digital artifacts, but also about broader investigative processes — including interagency cooperation. This round-up article includes three open-access articles from

How To Bulk Tag Evidence With Nuix Investigate

Today I’m going to show you how to do a bulk tagging operation using Nuix Investigate 8.2.1. Here on the far left side – you can see we’re on our Cases landing page – we’re going to scroll down the

COVID Fraud Is A Crisis Within A Crisis

In times of distress, or hardship, we’re told to “look for the helpers.” As Fred Rogers once explained, in “scary” times we can feel calmed and reassured because there will always be “people who are helping.” These people are the

BYOB To A CTF To Improve Your DFIR Game

Even before COVID-19 drove homebound digital forensics examiners to seek out new modes of training and skill-building, Capture the Flag (CTF) challenges were a popular feature at numerous conferences. Now offered in virtual formats both during and outside of conferences,

Strengthen Your Cases with Webpage Data in Magnet AXIOM 4.4

Magnet AXIOM 4.4 and Magnet AXIOM Cyber 4.4 are now available with built-in artifact support for results captured with the free MAGNET Web Page Saver tool, the ability to choose the evidence summaries included in your exports, and several new

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss smart TV acquisition. How do you determine the age of a person in images seized from a computer? Can you help this user with

How To Review Text Chats With Nuix Investigate

Today we’re going to take a look at how to review chat messages in Nuix Investigate, and the different viewing options. We currently have all the items retrieved through the grid, and we’re going to utilise the search filters on

SANS DFIR Summit 2020 Recap

The SANS DFIR Summit, the largest ever SANS Institute event thanks to a record 20,000 registered individuals, took place July 16-17 this year. In a fully virtual format owing to COVID-19 precautions, the Summit, said SANS Institute Fellow Rob Lee

Live Webinar: Insider Threat Detection, Triage, and Investigation

Nuix
Many enterprises struggle with identifying, planning, and implementing the core capabilities needed to prevent insider threats within the organization. Executive-level questions and concerns about whether the investments required for enterprise-scale tools are justified by insider threat risk alone make it

Staying Ahead of Mac Investigations with Apple Forensic Training

BlackBag’s Apple® Forensic Investigations (AF1) class focuses on evidence artifacts rather than parsed data. The idea is that attendees learn how to verify data found during analysis. The course prepares examiners to understand what the data is saying; how the

Trust But Verify: Digital Artifact Edition

Julie: Hi, everyone. Thanks for joining today’s webinar Trust But Verify: Digital Artifact Edition. My name is Julie O’Shea, and I’m the global marketing manager here at BlackBag. Before we get started today, there are some things that I’d like

HancomWITH – 2Q 2020 MD-Series Release Note Highlights

Check out the major features of MD-Series released in 2Q 2020, if you would like to know more go download PDF file. MD-NEXT v1.88.1-1.89.4 New iOS Full Filesystem(Checkm8) Extraction applied to iPhone series SE/6s/6s+/7/7+/8/8+/X New Physical Extraction for Samsung Galaxy

Josh Brunty On Digital Forensics Education

Christa: Hello, and welcome to the Forensic Focus podcast. Monthly, we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller.  Today,