Forensic Focus

Jobs

29th June 2026

Digital Forensics Jobs Round-Up, June 29 2026

Explore a selection of the latest DFIR employment opportunities in this week’s Forensic Focus jobs round-up....

David Shipley: Investigating The Darkest Corners Of Digital Evidence

25th June 2026

David Shipley joins the Forensic Focus Podcast to talk about the human cost of online safeguarding work and his fight to close a gap in UK law....read more

Articles

Deepfake Forensics: How To Analyze Suspected AI-Generated Images

25th June 2026

Deepfake forensics goes far beyond pressing a detection button: Amped Software explores why suspected AI-generated or manipulated images require a structured, explainable, and defensible forensic workflow....read more

Videos

Cellebrite Genesis: Get Case Insights In Minutes

25th June 2026

Cellebrite Genesis uses agentic AI to help investigators analyse complex digital evidence, surface connections, and move from data to actionable intelligence faster....read more

Knock, Knock, Log: Threat Analysis, Detection & Mitigation of Covert Channels in Syslog Using Port Scans as Cover

2nd August 2022

In this paper, Kevin Lamshöft describes how researchers performed a threat analysis for a covert Command and Control (C2) channel using port scans as cover and syslog as carrier for data infiltration. Session Chair: So, Kevin is presenting Knock, Knock

Distant Traces and Their Use in Crime Scene Investigation

28th July 2022

Starting with a physical crime scene – a fire – Manon Fischer describes how IoT devices such as “smart” plugs and thermostats store “distant traces” remotely, and could be used to help reconstruct a fire’s origin, cause, and timeline. Session

Passware Kit 2022 v3 – Deleted Data Recovery from Encrypted FileVault/APFS Images

28th July 2022

What’s new in Passware Kit 2022 v3: Recovery of deleted data for APFS images Decryption of QuickBooks for Mac 2022 databases GPU acceleration for bcrypt password recovery Updated password recovery for Acronis backups Password recovery for Dashlane for Mac Improved

The Wisdom of the Heap: Mesh It up by Weaving Data Structures

26th July 2022

In this short presentation, Trufflepig Forensics’ Aaron Hartel and Christian Müller present some early stage research about the volatility of data in memory as data structures change version to version. Session Chair: We’re now going over to memory forensics and

Case Study: How a UK law enforcement agency solved more crimes faster with less investment

25th July 202225th July 2022

Implementing the MSAB Ecosystem saved a UK Law Enforcement Agency £80K over three years The challenge The use of digital evidence has significantly increased in the past few decades as the courts have increasingly started to accept digital files as

Oxygen Forensics Introduces User-Focused Advancements In Latest Release

22nd July 2022

Oxygen Forensics has released the latest version of the all-in-one digital forensic solution, Oxygen Forensic® Detective v.14.6. This version adds support for multiple new backups, continues to improve the iOS Agent extractor, and introduces a new analytic feature. Brute-force for

Toward Graph-Based Network Traffic Analysis and Incident Investigation

21st July 2022

At DFRWS-EU 2022, Milan Cermak describes the need to create data associations for use during network traffic analysis and incident investigation. The focus is on robust graph data visualization of the kind that’s commonly used in criminal investigation, allowing analysts

2022 2Q MD-Series Release Note Highlights

20th July 2022

Find out the major features in MD-Series that are supported in 2Q 2022. MD-NEXT v1.91.4–v1.91.9 Supports new 2,428 models, updated 783 Models. Android Full filesystem extraction method added Samsung Galaxy S22 Qualcomm Series. Supports iOS Checkm8 Full Filesystem (iOS 15.0∼15.2.1

Memory Forensic Analysis of a Programmable Logic Controller in Industrial Control Systems

19th July 2022

Winner of the Best Student Paper Award at DFRWS-EU 2022! Muhammad Haris Rais describes a step-wise approach to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. By following a methodology that focused

Get Ready for the Next Big Reveal From Grayshift

19th July 2022

Grayshift continues to extend its strength in lawful access and extraction capabilities As a leader in cell phone forensics, Grayshift, has been hard at work developing new features for law enforcement partners like you. We strive to provide law enforcement

Frontline Managed Services’ Kyle Campbell on DFIR & E-Discovery Skills & Pathways

18th July 2022

Christa: Electronic discovery, or e-discovery, has always required some digital forensic skills as litigators prepare to present electronic data at trial. However, as technology evolves, likewise, the skills needed to identify, collect and analyze the data that’s most relevant to

MSAB – a Major Player in IDC report on Digital Forensics

15th July 2022

MSAB, a global leader in digital forensic technology for mobile device examination and analysis, announced it has been named as a Major Player in the IDC MarketScape: Worldwide Digital Forensics in Public Safety 2022 Vendor Assessment. The report noted that

PEM: Remote Forensic Acquisition of PLC Memory in Industrial Control Systems

14th July 202214th July 2022

Winner of the Best Paper Award at DFRWS-EU 2022, Nauman Zubair proposes a new memory acquisition framework to remotely acquire a programmable logic controller (PLC)’s volatile memory while the PLC is controlling a physical process. Session Chair: Welcome Nauman, happy

When Did It Happen? Dealing With Timestamps in Amped FIVE

13th July 2022

By David Spreadborough – Forensic Video Analyst at Amped Software There are several common components within a CCTV Video file. This article from Amped Software is going to dive into the data that links the image to the time when

Passware Kit Mobile 2022 v3 – GPU-Accelerated Password Recovery for MediaTek-Based LG Smartphones

13th July 2022

What’s new in Passware Kit Mobile 2022 v3: GPU-accelerated password recovery for MediaTek-based LG devices Data extraction from applications on LG: Signal, Wickr, 1Password iOS 15.5 support Support for Apple devices with A9X chip Support for HFS+ (iOS prior to

Defining Atomicity (and Integrity) for Snapshots of Storage in Forensic Computing

12th July 2022

In this video from DFRWS-EU 2022, Jenny Ottmann revisits the discussion on quality criteria for “forensically sound” acquisition of such storage and proposes a new way to capture the intent to acquire an instantaneous snapshot from a single target system;