Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

6 Month Checkup at Oxygen Forensics

We’re halfway through the year, and it is time to recap what useful features we have introduced to the forensic community. Undoubtedly a challenging time; however, we released four significant updates with a tremendous amount of enhancements in all our

Get DVRConv 17521 with H.264 Quality Settings and New Formats

Did you know that Amped DVRConv is the easiest way to convert unplayable video files? Videos from proprietary CCTV/DVR systems, dashcams, body worn cameras, and any other video source can now be converted without effort. With Amped DVRConv, you just

Put Your Lab’s Existing Tools And Processes To Work — For Science

Digital forensic tools rely on the National Institute of Standards and Technology (NIST)’s National Software Reference Library (NSRL), the standard reference dataset, to filter out known software and images from unknown ones. Forensic examiners, judges, and attorneys rely on NIST’s

Get Amped FIVE Update 17338 With Three New Filters And Much More

Amped Software is happy to announce a very exciting update to Amped FIVE, the most complete image processing software specifically designed for forensic lab experts to manage the complete image and video analysis workflow, with advanced and fully customizable processes

MSAB New Release: XRY 9.1, XAMN 5.1 And XEC Export 6.0.1

Significantly increase the amount of location data, extract more refined data from more devices more securely and in less time, view content from warrant returns and more. Today’s release of new versions of XRY, XAMN and XEC Export represents a

Passware: Tips for Efficient TrueCrypt/VeraCrypt Decryption

VeraCrypt and the former TrueCrypt are two of the most challenging types of encryption to bypass with regard to their popularity as full disk encryption software. Unlike Bitlocker encryption, TrueCrypt/VeraCrypt may encrypt their containers and volumes with multiple encryption keys

Mitigating Risk Through Standardization

A recap of Dr Gillian Tully’s DFRWS EU keynote. By Christa Miller, Forensic Focus No one denies that digital forensics is becoming more complex. The range of devices to examine keeps increasing, as does the complexity of acquiring and analyzing

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss search and seizures during covid. Can you help Jayt4049 with this WD HDD which is going to sleep while imaging? Forum members discuss mounting

DFRWS Virtual Europe 2020 — Recap

by Christa Miller, Forensic Focus This year’s Digital Forensics Research Workshop (DFRWS) EU, originally intended to take place in Oxford, England in March 2020, instead moved online in June. The conference included: Fourteen paper presentations focused on memory forensics, digital

Telegram Messenger Data Extraction In Oxygen Forensic Detective

Telegram is a cloud-based instant messaging and voice over IP service launched in 2013 by the brothers Nikolai and Pavel Durov. According to the U.S. Securities and Exchange Commission, the number of monthly Telegram users as of October 2019 is

Navigating Digital Investigations In 2020 Using BlackLight And MacQuisition

Arvinder: Hi, everyone. Thanks for joining today’s webinar, Navigating Digital Investigations In 2020 Using BlackLight And MacQuisition. My name is Arvinder Garcha. I’m the Director of Channels at BlackBag for Asia Pacific and Latin America. So before we kick things