Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

How To Create A Full Forensic Image With Nuix Enterprise Collection Center

Nuix Enterprise Collection Center empowers ediscovery, digital forensics, and cybersecurity practitioners alike. Investigators are able to make a full forensic image, automated through the use of a simple collection wizard. After providing a case name, investigators are then able to

Breaking The Insanity Cycle: How Police Forces Can Eliminate Device Backlogs

Following a series of Freedom of Information (FOI) requests, the UK’s “The Times” newspaper published a story reporting that the 12,000 digital device backlog faced by UK Police in 2019 remains unchanged in 2020. For many working within the digital forensics community,

Highlights From The National Cybercrime Conference: Virtual Edition 2020

Virtualized online for the first time in its nearly decade-long history, the National Cybercrime Conference (NCCC)  — an annual event hosted by the Massachusetts Attorney General’s Office  — brought together a record 133 speakers to deliver a considerable volume of

Day-To-Day Challenges In Digital Forensics

All occupations face daily challenges. Many of these challenges come from dealing with the public, while some are more problem-solving challenges. In digital forensics, we face challenges on both ends of this spectrum because ultimately our jobs affect lives. Whether

Amped Authenticate 17658 Now Available with New Shadows Filter and More

Amped Software is happy to announce a very important update to Amped Authenticate, a software package that includes a collection of the most powerful, real-world-application authentication filters and techniques based on science. Ideal for digital forensic experts to exploit the

Digital Forensics Standards: Recent News And Research

The global COVID-19 pandemic hasn’t slowed either the pace of technological change or its relevance to both criminal and civil investigations. Both fraud and child exploitation are examples of crimes that have increased since much of the world went on

Atola Introduces RAID Assembly, Autodetection And Imaging In TaskForce

2020.7 release of TaskForce brings a brand new capability to assemble drives and image files into RAID arrays, automatically detect their configuration and image the volumes in a forensically sound manner. “TaskForce is now officially the first hardware RAID imager

BlackLight Version 10.1 Is Now Available

Sharing BlackLight case data has never been easier. BlackLight Version 10.1 has officially been released with powerful new enhancements. New and improved features include: BlackLight Portable Case Cluster map view in ‘Locations’ Added support for TrueCrypt and VeraCrypt volumes Support

Find Evidence Faster With A New JSON Viewer In Magnet AXIOM 4.3

Magnet AXIOM 4.3 and Magnet AXIOM Cyber 4.3 are now available! AXIOM 4.3 introduces an all-new JSON viewer along with new & updated artifacts — including Microsoft Teams, Instagram, Chrome, and Uber. Within AXIOM Cyber 4.3, you can now also

How To Use Annotations In Amped Replay

Some of you may be aware of Amped Replay, but for those who are not, Replay can be considered the VLC (and much more!) for investigators. It was designed to make the life of investigators easier by providing them with

How To Perform An Android 10 Full File Extraction With MD-NEXT

New release: MD-NEXT v.1.89.5  Full filesystem extraction is available for Samsung Galaxy S10/Note10 Series (Exynos) with Android 10 (FBE enabled), and this will support the Samsung Secure Folder. Check out the video! If you have any questions, feel free to

Recent Research In Digital Forensics

Despite pandemic-related disruptions in both research and publishing as we head into the summer, there are still some posts and papers being published. In this round-up, we take a look at three recent articles in digital forensics. An Evaluation of

Virtualizing The Digital Forensics Lab

When the spread of COVID-19 spurred businesses and governments to close their doors and require employees to work from home, questions arose for those working in the criminal justice system. Operations couldn’t end, but to what extent would they be