Forensic Focus

Articles

19th October 2026

Investigating WMI Permanent Event Subscription Persistence

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Today's headlines 20 Oct 2026

More news →

News

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

News

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

News

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

MSAB XAMN

22nd February 202315th June 2020

You’ve already extracted data from a mobile device, you’re up against the clock and you’re trying to analyze large amounts of mobile device and app data. Where do you start? Join us for a 30-minute free webinar and learn smart

Raven: An Android Mobile Exploitation Kit In A Portable Package

15th June 2020

Rapid triage extraction in the field for immediate actionable intelligence. MSAB is excited to announce the introduction of Raven, the new, innovative, highly portable mobile device exploitation toolset. It is specifically designed for operators in the field who need lightweight solutions

How To Extract Data From Samsung Galaxy S9 / Android 10 With MD-NEXT

15th June 202011th June 2020

In this video, we will introduce ‘Bootloader Pro’ extraction method which is capable of extracting Android 10 installed Samsung devices. Currently, MD-NEXT supports Galaxy S9(SM-G960N, SM-G960F)/Galaxy S9+(SM-G965N, SM-G965F)/Galaxy Note 9(SM-N960N) with Exynos chipset. If you have any further inquiries, contact

Amped Replay Update 16856 With Spotlight, Project Files Import/Export And Descriptions For Bookmarks

10th June 2020

Amped Software is happy to announce yet another update to Amped Replay, a universal video player for investigators, frontline officers, first responders, security personnel, and CCTV operators to conduct a quick first-level analysis of their video, with easy conversion, quick

Oxygen Forensics Adds Time Saving Features In New Release

10th June 2020

Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, announced today the release of Oxygen Forensic® Detective v.12.5. This release introduces features that will increase efficiency by implementing alternative solutions for law enforcement and

Register For Webinar: Thwarting Mac T-2 Encryption & SIP With AXIOM Cyber Remote Acquisition

10th June 2020

MacOS has created roadblocks for examiners for years. Investigators must contend with not only hardware-based encryption like the T-2 chip, to System Integrity Protection (SIP), which prevented disk and write access to specific directories across the Mac. Now with macOS

How to Identify Small Differences Between Two Times In A Video Using Amped FIVE

10th June 20209th June 2020

by David Spreadborough, Amped Software To help in setting the scene, let me tell you a story. A young guy decided to steal a charity box from a post office. The theft itself could not be seen on the video,

Digital Video Source Authentication: Groundbreaking Insights Into Digital Video Evidence

13th August 20208th June 2020

by Brandon Epstein, Walter Bruehs, Bertram Lyons, and Dan Fischer Video evidence is prolific in modern criminal investigations, and cell-phone video is one of the most prevalent ways video is captured [1]. While these silent witnesses can provide excellent investigative

Secure Your Digital Evidence Automatically From Telegram With XRY Photon

5th June 2020

New XRY 9.0.2 now released – with support for a brand new app in Photon Auto, plus added support for Samsung Galaxy S, A & J series with Exynos chipsets and support for newer Spreadtrum chipsets. TRY XRY FREE FOR

Magnet AXIOM 4.1 Is Here To Help You Get To The Evidence Faster And With More Efficiency

2nd June 2020

Magnet Forensics is continuing to build on the significant progress of Magnet AXIOM 4.0 and Magnet AXIOM Cyber 4.0 with Magnet AXIOM 4.1 and Magnet AXIOM Cyber 4.1! Find out below how AXIOM 4.1 will let you get to the

Following Up: When Digital Forensics Vendors Hire Research Talent, Where Does It Leave Research?

8th June 20201st June 2020

by Christa Miller, Forensic Focus When we published our March opinion piece, “When Digital Forensics Vendors Hire Research Talent, Where Does It Leave Research?” the reaction on Twitter — mostly from vendor representatives themselves — was swift and strong. While

AccessData Announces New Versions Of AccessData’s FTK® And AD Lab That Deliver Expanded And Enhanced Internet And Mobile Analysis

24th January 202529th May 2020

AccessData Group, a leading provider of integrated digital forensics and e-discovery software, recently announced the release of FTK® and AD Lab 7.3, new versions of the company’s digital forensics software solutions that feature enhancements that make it easier for users

Upcoming Webinar: Trust But Verify: Digital Artifact Edition

29th May 2020

How to make sure you’re telling the whole truth using supporting evidence in an investigation. Revealing the truth is our job as forensic analysts. Artifact parsing, in its efficiency, is helpful, but has the potential to steer us down the wrong

New Version Of AccessData’s AD Enterprise Expands Remote Data Collection Capabilities From Mac Operating Systems

27th May 2020

AccessData Group today announced the release of AD Enterprise 7.3, a new version of its software for managing internal forensic investigations and post-breach analysis that contains first-to-market remote Mac® agent deployment. The new version expands remote data collection capabilities to

Illicit Image Investigations Part One: Making The World A Safer Place

16th October 202126th May 2020

Keith: Hey, this is Keith Lockhart from oxygen forensics training. I have Amanda Mahan with me from our team. Welcome to a series of webinars about making the world a safer place. So our first in the series is using

Forensic Focus Legal Update: The COVID-19 Edition

22nd February 202325th May 2020

When employers worldwide instituted remote-work policies to help reduce the spread of the novel coronavirus COVID-19, the impact to entire criminal justice systems — from law enforcement to evidence processing through the courts — was profound. Digital evidence examiners in