Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 20 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Forensic Focus Forum Round-Up

Welcome to this month’s round-up of recent posts to the Forensic Focus forums. Forum members discuss IPv6 to IPv4 conversion in response to a warrant request. Can you explain why this prefetch folder is empty? How would you respond to

What’s Happening In Forensics – Jan 24, 2020

Steve Anson’s new book, Applied Incident Response, is now available on Amazon. Ciarán O’Brien has been working on a Jupyter notebook to help automate the process of pulling IOCs from artifacts recovered from compromised Citrix Netscalers. Heather Mahalik instigates a

Industry Roundup: Cloud Forensics

by Christa Miller Only a few short years ago, the idea of recovering forensic data from the cloud seemed like either troubling overreach, or unnecessarily redundant given the availability of evidence from mobile devices. As encryption became more prevalent on

Industry Roundup: Cloud Forensics

by Christa Miller Only a few short years ago, the idea of recovering forensic data from the cloud seemed like either troubling overreach, or unnecessarily redundant given the availability of evidence from mobile devices. As encryption became more prevalent on

What’s Happening In Forensics – Jan 23, 2020

Ryan Benson shows how Google search URLs can be a great source of digital forensic information. Magnet’s Jamie McQuaid discusses how deduplication can help your forensic analysis. Paraben’s Amber Schroader talks about getting started in digital forensics. Cellebrite share a

The iPhone Health App: A Forensic Perspective

Jan Peter van Zandwijk discusses his research at DFRWS EU 2019. Hello, my name is Jen Peter van Zandwijk. I work with the Netherlands Forensic Institute. And in this half-hour I will tell you about some research that they did

What’s Happening In Forensics – Jan 22, 2020

DFRWS announce a Women in Forensic Computing Workshop and Digital Forensics Bootcamp as part of this year’s EU conference. Mattia Epifani presents the CASE Ontology to the European Commission in Brussels. Mike Art Rebultan shares his route to a DFIR

Review: AccessData Enterprise From AccessData

by Jade James AccessData Enterprise enables investigators to forensically image and analyse devices. It also provides a means of workflow analysis and documentation, as well as a level of staff management. The inclusion of FTK means that examiners can conduct

What’s Happening In Forensics – Jan 21, 2020

Jessica Hyde shares a list of resources to help you keep up-to-date with mobile forensics. 13Cubed talk about CVEs in Windows event logs. Belkasoft discuss what’s new in Belkasoft Evidence Center v9.9.

The iPhone Health App: A Forensic Perspective

Jan Peter van Zandwijk discusses his research at DFRWS EU 2019.Hello, my name is Jen Peter van Zandwijk. I work with the Netherlands Forensic Institute. And in this half-hour I will tell you about some research that they did on

Graeme Horsman On The Fast Pace Of Digital Forensics

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community on a host of topics ranging from technical aspects to career soft skills. I’m your host, Christa Miller. Our

What’s Happening In Forensics – Jan 20, 2020

Brett Shavers discusses the importance of eating your broccoli first in digital forensics. Magnet Forensics’ Adam Belsher talks about how to deal with the digital evidence tsunami.

AccessData Enterprise From AccessData

by Jade James AccessData Enterprise enables investigators to forensically image and analyse devices. It also provides a means of workflow analysis and documentation, as well as a level of staff management. The inclusion of FTK means that examiners can conduct

Quality Management System Standards In Forensics: An Executive Overview

by Tim Alcock, Qualimetric This presentation is designed to give an executive overview of the Quality Management System standards and guidelines applicable to organisations providing forensic science services to the Criminal Justice System in the UK. Organisations can achieve independent

Quality Management System Standards In Forensics: An Executive Overview

by Tim Alcock, QualimetricThis presentation is designed to give an executive overview of the Quality Management System standards and guidelines applicable to organisations providing forensic science services to the Criminal Justice System in the UK.Organisations can achieve independent recognition to

What’s Happening In Forensics – Jan 17, 2020

Oleg Afonin discusses what information is stored in iCloud, and how much Apple will provide in response to government requests. Oleg Skulkin shows how to find Nextcloud storage forensic artifacts on endpoints.