Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 21 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

What’s Happening In Forensics – Nov 5, 2019

Martijn Grooten shares an Android malware similarity clustering method using an opcode sequence. Amped share how to generate computer-processable results with Authenticate. Arsenal have released Arsenal Image Mounter v3.0.84 Beta. Foxton Forensics share their first cyber puzzle challenge.

What Changes Do We Need To See In eDiscovery? Part V

by Harold Burt-Gerrans Welcome to Part 5. As promised in Part 4, I’ll start by discussing recursive de-duplication. I can’t count the number of times that clients have complained about x.400/x.500 addresses in emails. Unfortunately, if the collected data comes

What Changes Do We Need To See In eDiscovery? Part V

by Harold Burt-Gerrans Welcome to Part 5. As promised in Part 4, I’ll start by discussing recursive de-duplication. Recursive De-Duplication: Using Aliases Within De-Duplication I can’t count the number of times that clients have complained about x.400/x.500 addresses in emails.

What’s Happening In Forensics – Nov 4, 2019

Magnet have released AXIOM 3.7 with Google Warrant Returns, Mac Updates and more. Harlan Carvey continues his discussion of LNK files. The Eclectic Light Company talks about how summertime confuses Mac timestamps. Patrick Siewart discusses why call detail records analysis

Forensic Focus Reviewer Required

Forensic Focus is looking for a US-based reviewer to write objective and informative reviews of new digital forensic tools and solutions. In addition to gaining early access to new products, remuneration will also be provided. Reviewers will need to have

Brett Shavers On DFIR Training And Mental Health In Digital Forensics

Christa: Hello and welcome to the Forensic Focus podcast. Monthly we interview experts from the digital forensics and incident response community, on a host of topics ranging from technical aspects to soft skills. I’m your host, Christa Miller. Our inaugural

Webinar: The New And Improved XRY

A new webinar, The New And Improved XRY, is available to view here. Join the forum discussion here.View the webinar on YouTube here.Read a full transcript of the webinar here. Read More

The New And Improved XRY

Join the forum discussion here.View the webinar on YouTube here.Read a full transcript of the webinar here. Hello everyone. My name is Jacob Hulsey, I will be the presenter today, and my contact info is on the screen for you.

The Power Of Amped Authenticate For Investigating CSE Cases

by Lucy Carey-Shields When we talk about Amped Authenticate, you may automatically think of its use in detecting forged and manipulated images such as those created using editing software to portray a different scenario or message from that of the

New XRY 8.1.2: Unlock Samsung Galaxy (Exynos) Devices

New XRY 8.1.2 is now available — with added support for Samsung Galaxy S7/S8/S9 and A & J series with Exynos chipsets, a new option for radically faster targeted iOS extractions, 10 to 15 times faster extractions of selected newer

How To Collect And Share Digital Evidence Files With Prosecutors

In this short How To video, digital forensic specialist Rich Frawley will show you how to collect and share digital evidence files with prosecutors and third parties using ADF Software. This video is ideal for learning how to share evidence

How To Collect And Share Digital Evidence Files With Prosecutors

In this short How To video, digital forensic specialist Rich Frawley will show you how to collect and share digital evidence files with prosecutors and third parties using ADF Software. This video is ideal for learning how to share evidence

What Changes Do We Need To See In eDiscovery? Part IV

by Harold Burt-Gerrans In Part 3, I introduced the concept of consolidating duplicates by tracking Metadata at a DocID level and coding and/or document actions at a Document Level. For ease, I’m duplicating part of the example charts here as