Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Can you help to explain the time discrepancy here? Is it possible to recover an unsaved Notepad process? Forum members discuss how critical write-blocking is during on-site

Register For Webinar: Analyzing Data From iCloud File Sharing

Apple’s iCloud Drive is a valuable means of storing data in the cloud and making it accessible to all your iCloud connected devices. However, users were unable to share data directly from their iCloud Drive to other users; that is

Checkm8 exploit is now integrated in XRY 9.0.1

With a significant increase in extraction speed XRY 9.0.1 now includes a built-in jailbreak tool, based on the checkm8 exploit, which will enable users to jailbreak an unbroken iOS device from within XRY. DOWNLOAD NEW RELEASE TRY XRY FREE FOR

BlackBag Announces Release of BlackLight 2020 R1

With the release of BlackLight 2020 R1, BlackBag expanded the macOS artifacts processed to make it even more powerful in solving cases. BlackBag Technologies, a Cellebrite company, announces the release of BlackLight 2020 R1, adding the ability to process AirDrop

Ryan Duquette On The Challenges Of Fraud Investigations

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. Today

Ryan Duquette On The Challenges Of Fraud Investigations

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. Today

Amped Authenticate From Amped Software

by Jade James Digital image forensics is a niche branch of digital investigations, and the tools used are aimed to support ‘blind’ investigations. Amped Authenticate is a software package designed for forensic authentication and tamper detection on digital photos. Authenticate

Amped Authenticate From Amped Software

by Jade James Digital image forensics is a niche branch of digital investigations, and the tools used are aimed to support ‘blind’ investigations. Amped Authenticate is a software package designed for forensic authentication and tamper detection on digital photos. Authenticate

Keith Lockhart, Director Of Training, Oxygen Forensics

Keith, since we interviewed you last June, what's new? What has been your biggest accomplishment as Oxygen Forensics' Director of Training over the past year? It’s funny, at home we do “highs and lows” and while that’s usually a dinner

Keith Lockhart, Director Of Training, Oxygen Forensics

Keith, since we interviewed you last June, what's new? What has been your biggest accomplishment as Oxygen Forensics' Director of Training over the past year? It’s funny, at home we do “highs and lows” and while that’s usually a dinner

What To Do When Your Key Evidence Is Also Working From Home

by Alex Chatzistamatis & Dana Feeney | Nuix You may not remember the last time you weren’t wearing slippers, or what it’s like to be on a conference call in total peace and privacy, and you certainly aren’t alone. Despite

Industry Roundup: Online Digital Forensics Training

by Christa Miller, Forensic Focus Online digital forensics training has been around for a number of years, offered as a convenient alternative to in-person training for examiners who couldn’t travel or were otherwise resource-constrained. In an unforeseen twist, though, live

Industry Roundup: Online Digital Forensics Training

by Christa Miller, Forensic Focus  Online digital forensics training has been around for a number of years, offered as a convenient alternative to in-person training for examiners who couldn’t travel or were otherwise resource-constrained. In an unforeseen twist, though, live

Passware Kit 2020 v2: Mac Version Provides Access To APFS From Mac with T2

Apple takes privacy, security, and encryption very seriously. While the latest improvements in macOS and iOS security help users to keep their data safe, they also create additional challenges for forensic examiners. All the latest Apple computers are protected with

XRY 9.0, XAMN 5.0 And XEC 6.0 Are Now Available

We are happy to announce the release of XRY 9.0, XAMN 5.0 and XEC 6.0. These new product releases will help you and your organization extract and analyze mobile evidence and intelligence faster and easier than ever. WATCH THE RELEASE

See How Magnet OUTRIDER Can Help You Find CSAM Faster

Magnet Forensics is proud to announce the availability of Magnet OUTRIDER — a new way to help you quickly find CSAM to prioritize or flag devices for additional examination.In addition to previewing material, OUTRIDER can help you by empowering Investigators