Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
19th October 2026

Investigating WMI Permanent Event Subscription Persistence
Hero Image

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....

Read More

Today's headlines 21 Oct 2026

More news →

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

Forensic Focus Digest, 16 Oct 2026

Forensic Focus Digest, 16 Oct 2026

16th October 2026

Discover what’s new on Forensic Focus: explore how the City of Johannesburg uses Detego Global to accelerate investigations, see how MD-LIVE takes investigators from first connection to a court-ready report, learn how iVe analyzes vehicle data to reveal driver behavior, and more....read more

The Forensic Focus State Of DFIR Survey Is Now Open

The Forensic Focus State Of DFIR Survey Is Now Open

15th October 2026

Caseloads, AI, tools, hiring and careers: tell us what DFIR work looks like today. About 8 minutes, anonymous, with early access to the report...read more

Clearing The Way With Magnet OUTRIDER

Magnet Forensics is proud to introduce Magnet OUTRIDER — a new and easy way for officers and investigators to check devices for digital contraband. OUTRIDER is an intuitive preview tool that quickly scans smartphones and computers to determine if there

What Changes Do We Need To See In eDiscovery? Part III

by Harold Burt-Gerrans At the end of Part 2, I put forth an argument that de-duplication should always be done globally to bring the data set down to just unique documents. And now that you’re convinced (or should have been)

What Changes Do We Need To See In eDiscovery? Part III

by Harold Burt-Gerrans Duplicative Documents At the end of Part 2, I put forth an argument that de-duplication should always be done globally to bring the data set down to just unique documents. And now that you’re convinced (or should

Crimes Against Children Conference 2019 Recap Part I: Technology

by Christa Miller, Forensic Focus Celebrating its 31st year, the Crimes Against Children Conference ran from 12-15 July 2019 in Dallas, Texas. The conference kicked off with opening remarks by Lynn M. Davis, President and Chief Executive Officer of the

Crimes Against Children Conference 2019 Recap Part I: Technology

by Christa Miller, Forensic Focus  Celebrating its 31st year, the Crimes Against Children Conference ran from 12-15 July 2019 in Dallas, Texas. The conference kicked off with opening remarks by Lynn M. Davis, President and Chief Executive Officer of the

Amped Software Is Hiring A Forensic Expert And Software Trainer

Amped Software is currently hiring a Forensic Expert and Software Trainer to join their team at its headquarters in Trieste, Italy (a remote position can be considered). Amped Software develops solutions for the analysis and enhancement of images and videos

How To Boot Scan A Mac With APFS And FileVault 2

Hi, I’m Rich Frawley and I’m the Digital Forensic Specialist with ADF Solutions. Today we are going to conduct a boot scan of a MacBook Air that has APFS and FileVault 2 enabled. At this point you have decided on

How To Boot Scan A Mac With APFS And FileVault 2

Hi, I’m Rich Frawley and I’m the Digital Forensic Specialist with ADF Solutions. Today we are going to conduct a boot scan of a MacBook Air that has APFS and FileVault 2 enabled. At this point you have decided on

What’s Happening In Forensics – Oct 16, 2019

Haroen Bashir of Fox-IT shows how to use machine learning to detect random filenames. The Eclectic Light Company looks inside MacOS Catalina's unified log. John Patzakis talks about why incident reporting requirements under GDPR and CCPA require strict protocols when

What’s Happening In Forensics – Oct 15, 2019

A new utility can now export event logs into different formats. Amped show how to get a better visual inspection of image evidence. US Attorney General William Barr has urged Facebook not to introduce encryption to its Messenger service, since