Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

How To Collect Data Using MacQuisition Live

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac systems without having to send MacQuisition hardware to someone’s home. In order to help our

How To Collect Data Using MacQuisition Live

As more employees are required to work from home, we’ve heard from our customers that they need the ability to remotely collect data from Mac systems without having to send MacQuisition hardware to someone’s home. In order to help our

Oxygen Forensics Adds Exclusive Huawei Device Capabilities With New Release

Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced the release of Oxygen Forensic® Detective (12.3), the company’s flagship software. In addition to providing customers with a number of powerful new features,

Nuix And MSAB Deepen Product Integration For Frictionless Workflows

Global software company Nuix (www.nuix.com) and MSAB, a pioneer in mobile device forensic examination, today announced a new integration for transferring mobile device data from MSAB XAMN to Nuix Workstation for analysis alongside other devices and digital evidence sources.“The dramatically

Catalina: A Voyage Through Apple’s New Artifacts

Apple’s ever-changing features and updates can make it hard to keep up with the latest changes to the file system and understand how it impacts your investigations.Join BlackBag for an upcoming webinar where you will hear from BlackBag’s Chief Scientist

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. What tools would you recommend for MacOS remote forensic collection? Can you help CopyRight with a question about internal hard disk removal logs? How would you process

How To Decrypt WhatsApp Messages With Oxygen Forensic Detective

Welcome to Oxygen Forensic Detective’s Knowledge Nuggets. In this video we’re going to discuss decrypting WhatsApp messaging. Let’s go over a few very important points that you need to consider before analyzing WhatsApp. Number one: always place the device in

How To Decrypt WhatsApp Messages With Oxygen Forensic Detective

Welcome to Oxygen Forensic Detective’s Knowledge Nuggets. In this video we’re going to discuss decrypting WhatsApp messaging. Let’s go over a few very important points that you need to consider before analyzing WhatsApp.  Number one: always place the device in

BlackBag Announces New Live Instructor-Led Virtual Training Courses

BlackBag’s industry-leading courses, Basic Forensic Investigations, Windows Forensic Investigations, and Apple Forensic Investigations are now available as live, virtual courses.BlackBag Technologies, a Cellebrite company, announces new live, instructor-led virtual training to give examiners of all levels the opportunity to experience

Oxygen Forensics Offers Free Remote Trainings During COVID-19 Crisis

The COVID-19 pandemic has reshaped our world almost overnight—upending daily routines and disrupting much of the global economy. Unfortunately, crime never takes a day off, not even during times of crisis. Ongoing digital forensics investigations have lost none of their