headlines

Today: Edge DFIR Toolkit covers 10 platforms, 92 artifacts and 142 detections with Sigma and YARA rules; ALEAPP gains a KeepSafe parser recovering EXIF metadata and GPS coordinates from Android vault files, and more.

Today: Cellebrite Genesis brings agentic AI to digital investigations, introduced by Matt Goeckel; Magnet Forensics unifies GrayKey, AXIOM and Griffeye under Magnet One to cut lab backlogs, and more.

Today: Cellebrite Autumn 2026 Release expands Genesis AI with drone forensics and CDR analysis; Citizen Lab, Amnesty and SHARE Foundation confirm Serbia used Pegasus and NoviSpy against 15 targets, and more.

Today: Eric Zimmerman’s forensic tools migrate from .NET 9 to .NET 10 LTS; Six LEAPP tools add SHA-256 hashing, LVM2, LUKS, RAID support and new artifacts, and more.

Today: Semantics 21 offers S21 VisionX, S21 CCTV and S21 Transcriber for offline forensic analysis; Passware Kit 2026 v4 adds YellowKey BitLocker recovery, E01 export and eCryptfs support, and more.

Today: Europol and European Commission identify cloud, IoT and vehicle forensics gaps across EU member states; Framework guides examiners and attorneys on evidence authentication, attribution and courtroom testimony, and more.

Today: Vitalii Kukhol details WMI permanent subscription detection using Sysmon, Volatility 3 and scrcons.exe artifacts; Atola Technology releases TaskForce firmware 2026.10 with a Compare module and Seagate fraud detection, and more.

Today: Europol and the European Commission identify cloud, IoT and vehicle forensics gaps across EU Member States; Georgia Tech researchers build ORISA to recover deleted AI assistant chats from Android memory, and more.

Today: Forensic Focus State of DFIR Survey opens, closing 30 November 2026 with results due January; Magnet Autokey extracts vehicle infotainment data including GPS, door events and connected device logs, and more.

Today: Semantics 21 offers S21 VisionX, S21 CCTV and S21 Transcriber to replace legacy tools; eBPF rootkits LinkPro and VoidLink suppress EDR visibility at kernel level, and more.

Today: Guocai Wang shows how blur type, not blur alone, drives licence plate enhancement decisions; iVe analysis of a 2026 Hyundai Kona distinguished deliberate from accidental driving in a UK murder case, and more.

Today: VLEAPP grows from 103 to 202 artifacts, adding Ford SYNC, GM OnStar and BMW MGU support; VESTIGEX releases as a new free Windows desktop platform for DFIR, and more.

Today: F3 hosts a free cryptocurrency investigation day at the FCA’s Stratford Cross venue on 29 October 2026; Amped User Days returns as a free online event on February 23-25, 2027 for its 7th edition, and more.

Today: S21 Transcriber converts recordings to searchable text offline; Scalpel3 reconstructs fragmented files from wiped devices, and more.

Today: LSU releases Scalpel3, an open-source parallel tool that reconstructs fragmented files across 619 types; DFRWS updates the open-source SOLVE-IT knowledge base, and more.

Today: Belkasoft X covers iOS and Android acquisition from iTunes backups to chipset-level imaging; SANS publishes Dynamic Incident Response: A Framework for Security Teams, and more.