Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Australian Police: XAMN Helped Solve Armed Robbery

By: Jeremy Byers, a police investigator in Australia This post was originally written and published on the MSAB blog I have been employed as a member of the Australian Federal Police and the South Australian Police since 2008. Most of

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Can you tell whether files have been copied from one USB to another? What temperature should your forensic lab be? How do you process large amounts of

What’s Happening In Forensics – Feb 20, 2020

Nominations are open for the 2020 Forensic 4:Cast awards. FireEye discuss how to correlate user search LNK files. Group IB share a forensic view of Chromium-based Microsoft Edge. ElcomSoft release iOS Forensic Toolkit 5.30, including jailbreak-free extraction for multiple Apple

Register For Webinar: Triaging Digital Evidence With MacQuisition

Have you ever served a search warrant and stared at the mountainous amount of digital media collected and wondered how much is actually related to your investigation? Or, have you had to undertake terabytes of storage media and wondered if

Interview With Steve Lin, President, Susteen

Steve, you've been Susteen's president for a little more than two years. Tell us more about what led you to the company and what appealed to you about leading it. The reason I joined the company is because we can

Steve Lin, President, Susteen

Steve, you've been Susteen's president for a little more than two years. Tell us more about what led you to the company and what appealed to you about leading it. The reason I joined the company is because we can

What’s Happening In Forensics – Feb 19, 2020

Belkasoft now supports checkm8 acquisition. Cellebrite share a case study showing how extraction of deleted videos can help in criminal investigations. Peter M. Stewart shares a round-up of Defcon 2019 DFIR CTF.

Oxygen Forensics Introduces Partnership With Latent Wireless

Oxygen Forensics announces Oxygen Forensics Detective 12.2 update, including import features for Instagram and Facebook warrants, advanced iOS and Android OS extraction capabilities Oxygen Forensics, a global leader in digital forensics for law enforcement, federal, and corporate clients, today announced

NIST Tests Forensic Methods For Getting Data From Damaged Mobile Phones

by Richard Press Criminals sometimes damage their mobile phones in an attempt to destroy evidence. They might smash, shoot, submerge or cook their phones, but forensics experts can often retrieve the evidence anyway. Now, researchers at the National Institute of

NIST Tests Forensic Methods For Getting Data From Damaged Mobile Phones

by Richard Press Criminals sometimes damage their mobile phones in an attempt to destroy evidence. They might smash, shoot, submerge or cook their phones, but forensics experts can often retrieve the evidence anyway. Now, researchers at the National Institute of

What’s Happening In Forensics – Feb 13, 2020

Heather Mahalik shares some tips for unlocking extra data in iPhone extractions. Ian Barwise talks about what it’s like to be a digital forensic examiner, and looks at some subsets of the career path. Joseph W. Shaw II discusses why

The Rise Of Evil HID Devices

Arthur Villeneuve and Franck Bitsch discuss their research at DFRWS EU 2019. Arthur: Good morning. My name is Arthur, this is Franck. We are going to talk about malicious HID devices. We represent what is HID devices just after. We’re

The Rise Of Evil HID Devices

Arthur Villeneuve and Franck Bitsch discuss their research at DFRWS EU 2019.Arthur: Good morning. My name is Arthur, this is Franck. We are going to talk about malicious HID devices. We represent what is HID devices just after. We’re working

What’s Happening In Forensics – Feb 12, 2020

Amped Software demonstrate how to investigate which camera model took a picture using EXIF metadata and JPEG quantization tables. The call for presentations and workshops is open for DFRWS USA 2020. Ed Michael reminds us about the importance of taking