Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
21st October 2026

How Semantics 21 Is Changing The Way Investigators Work With Digital Evidence
Hero Image

Digital evidence has evolved, but have your investigative workflows kept pace? Discover how Semantics 21 is helping investigators reduce manual effort, prioritise critical evidence and work smarter with modern forensic intelligence tools....

Read More

Today's headlines 21 Oct 2026

More news →

Passware Kit 2026 v4 Simplifies BitLocker Decryption And Adds E01 Export

Passware Kit 2026 v4 Simplifies BitLocker Decryption And Adds E01 Export

21st October 2026

Passware Kit 2026 v4 is here with expanded BitLocker decryption support for AMD and Lenovo devices, the new YellowKey method, Linux eCryptfs decryption, E01 export, and enhanced Apple support....read more

Investigating WMI Permanent Event Subscription Persistence

Investigating WMI Permanent Event Subscription Persistence

19th October 2026

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup....read more

Atola TaskForce Gets A Massive Update Including A New Compare Module

Atola TaskForce Gets A Massive Update Including A New Compare Module

19th October 2026

Meet Atola TaskForce firmware 2026.10, featuring a brand-new sector-by-sector Compare module, detection of used-drive fraud on Seagate devices, enhanced Web API automation, and 30+ improvements across forensic imaging workflows....read more

What’s Happening In Forensics

Chris Dale interviews Julia Helmer of Consilio about mobile data. A new fingerprinting technique developed by researchers at the University of Cambridge allows websites to uniquely identify phones based on data from the accelerometer, gyroscope, and magnetometer sensors. John Patzakis

Oxygen Forensics Announces Facial Recognition

Oxygen Forensics, a leading global provider of digital forensic investigation software to law enforcement, government, and enterprise organizations, announced its strategic partnership with Rank One Computing, a leading provider of facial recognition and biometrics technology.Rank One’s facial recognition technology will

What’s Happening In Forensics

Amped posted a blog about how to deal with interlaced videos in Amped FIVE. Alexis Brignoni demonstrates how to find Badoo chats in Android using SQL queries and the MAGNET App Simulator. Hexacorn plays with delay-loaded DLLs. Harlan Carvey talks

What’s Happening In Forensics

Techno Security MB is under way – keep up to date on Twitter. Binary Hick gives us an in-depth look at Snapchat on Android. Ali Hadi looks at Windows InstallTime vs InstallDate registry values. Foursquare has acquired Placed, meaning it

What’s Happening In Forensics

BlackBag Tech have announced that MacQuisition can now produce decrypted physical images of Apple’s latest systems using the T2 chip. Find Ashley Hernandez’s demonstration here. Didier Stevens has updated hex-to-bin.py to Version 0.0.2, which comes with an option to parse

Interview With Kim Hyun-soo, CEO, HancomGMD

Tell us a bit about your role: what does a day in your life look like? I am Kim Hyun-soo, a founder of HancomGMD. Over the years, my daily routine has been very focused on the sole purpose of making

Kim Hyun-soo, CEO, HancomGMD

Tell us a bit about your role: what does a day in your life look like? I am Kim Hyun-soo, a founder of HancomGMD. Over the years, my daily routine has been very focused on the sole purpose of making

What’s Happening In Forensics

Hexacorn suggests that the Run key in the Windows registry could be interesting for forensic investigators to look at. Harlan Carvey wrote a post discussing troubleshooting and deep knowledge, or what to do when a tool that we’re using doesn’t

The Opportunity In The Crisis: ICS Malware Digital Forensics

by Christa Miller, Forensic Focus Malware aimed at industrial control systems (ICS) is nothing new. Nearly 10 years have passed since Stuxnet first targeted the supervisory control and data acquisition (SCADA) systems and programmable logic controllers (PLCs) associated with centrifuges

What’s Happening In Forensics

The Byton M-Byte is “a premium vehicle, the crowning glory of which is an enormous 4K screen that spreads across the full width of the dashboard, eliminating the need for conventional instruments and dials.” A great repository of information for

AccessData’s AD Enterprise Automates Early Data Collection

Company also rolls out new versions of FTK and AD Lab with enhancements that leverage machine learning to speed up forensics investigations. AccessData Group today announced the release of AD Enterprise 7.1, a new version of its software for managing

Leveraging DKIM In Email Forensics

by Arman Gungor My last article was about using the Content-Length header field in email forensics. While the Content-Length header is very useful, it has a couple of major shortcomings: • Most email messages do not have the Content-Length header

Leveraging DKIM In Email Forensics

by Arman Gungor My last article was about using the Content-Length header field in email forensics. While the Content-Length header is very useful, it has a couple of major shortcomings: Most email messages do not have the Content-Length header field