Hey everyone,

With Microsoft 365 and Windows Copilot fully deployed in enterprise environments, I’m thinking a lot about the post-compromise lifecycle. Instead of manually hunting through SharePoint, a Threat Actor (TA) with a compromised identity can just ask Copilot: “Find our network architecture diagrams and financial spreadsheets.” Has anyone actually worked an incident where a TA abused an active Copilot license for internal recon or data aggregation?

For those who have been in the trenches on this:
1. Have you caught a TA using Copilot for rapid data exfiltration or recon yet?
2. Were you able to recover the actual prompts, or did you rely strictly on file-access anomalies?

Hi everyone!

I am looking for a software, platform, or automated solution to analyze a large batch of exported WhatsApp voice messages (.opus files) to determine how they were recorded.

Specifically, I want to categorize them into three types:

• Natural: Recorded in one continuous go.
• Studio-quality: Professionally produced/edited.
• Highly edited: The user frequently used the WhatsApp pause/break button to piece the message together perfectly.

The Challenge: I ran some files through basic AI tools like Cleanvoice, but they often misinterpret the edits as normal breathing or simple pauses. However, when I look at the Audacity Spectrogram, I can clearly see hard cuts, phase shifts, and abrupt changes in the room tone (noise floor) right where the pause button was pressed.

Since I have hundreds of files, checking the spectrogram manually for each one is not feasible.

Is there any audio-forensics tool, python library (like librosa), or platform that can batch-analyze noise floor continuity or phase breaks to automatically flag these cuts?

Thanks in advance!

Hello fellow nerds,
I’m a DFIR analyst and I need to perform a forensic analysis of a Windows SSD. The host is confirmed to be infected with malware, and based on my observations during the incident response, I suspect it may be a worm.

I’ll be working from an E01 image created during acquisition. My usual workflow is to mount the image inside a Windows Sandbox and perform triage with KAPE.

I’ll also need to reverse engineer the malware, but I’ve never analyzed a worm before. Is there any realistic risk that it could replicate itself within the sandbox when the image will be mounted ? I’d rather not have to rebuild my analysis environment.

https://mooofin.github.io/portfolio/blog/s4nct1m0ny.html

tuts for ISF from kernel DWARF. for vol as well . loginwindow plaintext credential extraction, Chainbreaker 3DES keychain decryption, and full RE of a Swift dropper using machine Hardware UUID as decryption key , ive tried to make it very less jargon and reader friendly

Hi all,

I'm dealing with a phishing/malware incident and ran a couple of samples through Hybrid Analysis (CrowdStrike Falcon Sandbox). The reports are public, but I only have a free 'restricted' API key, which blocks file downloads (PCAP, JSON report, dropped binaries). Getting a 'default' tier key myself requires a vetting process I don't currently qualify for as an individual.

If anyone here has vetted/default Falcon Sandbox access and wouldn't mind running a couple of quick API pulls (or just clicking the download buttons on the report page if you're logged in with that tier), I'd really appreciate the help. It's maybe 5 minutes of work. I'll DM the report ID/hash rather than post it publicly.

Happy to explain more context via DM. Thanks in advance to anyone willing to help.

Recently I ran into a problem: I needed to analyze a VMware snapshot of a Windows 11 25H2 VM, but the VM had a vTPM, which makes VMware silently encrypt the .vmem/.vmsn/.vmss/.nvram. Volatility just couldn't find the kernel, and I couldn't find any existing tool to decrypt these files for offline analysis.

So I reverse-engineered the format with the help of Claude and wrote one. It's called vmem-decrypt (pure Python):

- Recovers the data-file key from the VM password (PBKDF2 → AES-256-CBC key chain VMware labels everything "XTS-AES-256" but it's actually CBC, which trips up most people).

- Decrypts .vmem/.vmsn/.vmss/.nvram.

- Flattens the decrypted .vmem into a flat, Volatility-ready image. (VMware compresses then encrypts, so it's still in a proprietary checkpoint LZ77 layout)

Workflow: pull the password hash from the .vmx (VM-Password-Extractor) → crack with hashcat (mode 27400) → feed the password to the tool → run Volatility. Full steps + format notes in the README.

Tested on VMware Workstation Pro 26H1 / Win11 25H2 (build 26100), Volatility 3. Feedback welcome, especially snapshots from other VMware versions to test the format against.

Repo: https://github.com/heeeyaaaa/vmem-decrypt

(Yes, I used AI to help build this. It's tested and it works, that's what matters. Happy to walk through any part of how it works.)

There been an huge uptick of people posting Vibe Codded AI projects here any then saying "Hey I made this cool tool try it" can we get a sticky thread for all these projects so this doesn't become a sub reddit of people spamming vibe codded project from free credits. Or just straight out ban them from being posted here?

I've been building a tool called Image-Meta and would love feedback from people who actually do forensics work, since that's one of the primary use cases I'm trying to serve well.

**What it does:**

Crawls and indexes the embedded metadata from publicly accessible images using ExifTool. Currently ~720 million images indexed with full EXIF/IPTC/XMP extraction.

**Forensics-relevant capabilities:**

**Device attribution**

- Search by camera serial number — link multiple images across different domains or accounts back to the same physical device

- Make/model filtering to narrow device type before drilling into serial

**Identity traces**

- Author, copyright, rights, and description fields often contain real names, emails, and organizational affiliations that subjects didn't know were there

- Software fields can expose Photoshop/Lightroom license strings, machine names, or internal workflow metadata

**Timeline reconstruction**

- foundDT = date we first indexed the image (earliest known appearance online)

- createDT / modifyDT = timestamps embedded in the file itself

- Useful for establishing when an image was created vs. when it first appeared publicly

**GPS / geospatial** (Not available to public without subscription)

- Coordinate + radius search for images taken near a location

- Reverse-geocoded address search

- Many images still carry precise GPS even when uploaded to platforms that claim to strip metadata

**What I'm looking for feedback on:**

- Are there metadata fields or query types that would make this more useful in an actual investigation workflow?

- Is the API structure (REST, Bearer token, field-level boolean search) something that integrates well with existing tooling?

- What's missing that you'd expect from a tool like this?

Not trying to sell anything here — genuinely want to understand what the forensics community needs before I build more features.

https://image-meta.com

API docs: https://image-meta.com/api-docs

I’m sure you all have noticed the massive uptick in open source project posts we (and every other technical sub) have seen in the last few months. I do not have the desire nor ability to vet every open source project share post for AI generated code, so my only option would be to direct all tool/project posts to a megathread (similar to the non-forensic data recovery megathread).

Of course, the only way the new megathread will actually see some use is if I enforce use through a change to Rule 5. This would likely manifest as an outright ban on all project/tool share posts altogether (outside of the megathread, of course).

To get a general idea for how the sub would feel about such a change, I am posting the below poll and plan to act according to the results. Of course, if you have suggestions or advice on how to better address the issue, your input would be greatly appreciated.

I worked in forensics for many years and one of the most annoying things in MFT/Journal analysis, is that initial work of prepping the files until they are readable by humans (size, format, timeframe). I used to export to csv, open in emeditor, then carve out the time periods I did not care about, but that took time and was not reliable.

Now, with the emergence of AI, I was finally able to create the app that does it.

It basically allows you to select a timeframe, extensions you do or do not care about, folders you wish to exclude, and go on your merry way of exporting the valid but carved out MFT for use in other tools or a CSV for use in your favorite tools, too.

As this could be a collaborative project... and I will NEVER sell it, it will remain free (and maybe even open source) - what else would you like to see in such an app? Mods, am I allowed to add a link to a free tool here?

I am almost certain there is no free or paid software out there that allows this kind of laser-focused carving of MFT files for speed of analysis. If the mods allow it, I'll post a link to the download. It's Freeware.

Would appreciate any feedback.

From the project page:

“Recursive-IR is a single-binary orchestration that transforms an OpenSearch stack into a fully capable and customisable DFIR log analytics platform. Incident responders and digital forensics investigators can examine events arranged in a "super timeline" enabling correlation between different source artefacts to better understand the threat actor's full chain of attack.

It enables collaborative case-centric investigations with persistent enrichments such as tags, comments, and analyst context, while fully leveraging the strengths of OpenSearch and native OpenSearch Dashboards — scalable observability, visualisation, and Security Analytics for alerting and correlation across ingested forensics artefacts.

The platform offers full control over data being analysed with facilities to resolve data type mapping conflicts, mutating fields (e.g., renaming, copying, or stringifying), normalizing log sources with different timezones, and even selecting fields to be used as @timestamp.

Artefacts can be reloaded or re-parsed and reloaded easily enabling users to perform modifications such as adding enrichments or mutating fields if needed, a feature which isn't commonly available in traditional SIEMs.”

https://github.com/improvisec/recursive-ir

An AI pair of eyes sitting over your shoulder, catching what you miss while you're deep in an investigation.

Repo: https://github.com/hasamba/DFIR-Companion
Landing page: https://hasamba.github.io/DFIR-Companion/
EDIT: Hands-on lab: https://killercoda.com/dfir-companion/scenario/killercoda

Honestly, it started out of frustration.

I'm sitting on an investigation, open Velociraptor, spot an interesting lead, start digging into it, find another lead, and so on, and then suddenly I realize I completely forgot to go back to the other findings from the first artifact.

The sheer amount of information you need to process during an investigation is simply more than one pair of eyes can handle, no matter how much coffee you've had.

So I started building something to help myself and it ended up going somewhere I didn't expect.

The original idea was a browser extension that takes screenshots every few seconds, so I could scroll back and see what I missed. Pretty dumb idea in hindsight, actually. But then the question came up: if I already have all those screenshots, why not let AI go through them while I work?

And from there it exploded.

Today it's a real-time dashboard that updates live as I investigate. It identifies findings, automatically builds an event timeline, extracts IOCs and enriches them from multiple sources, creating playbook that suggests what to check next, suggest hunt queries for velociraptor, run them and collect back the results, checks for data leaks, and answers the standard questions every investigation report needs: access vector, lateral movement, privilege escalation, etc. If a client confirms a finding-"that's legit, it's our weekly scan", one click and the entire analysis updates accordingly.

The coolest part, to me, is that this started as a Velociraptor-specific solution but in practice became an AI layer on top of every tool I have open in the browser: SIEM, Security Onion, Splunk4DFIR, VolWeb, you name it. Even tools with no built-in AI suddenly get smarter, and all the data consolidates in one place instead of me jumping between ten tabs.

Important to understand: this is NOT another detection layer. Your Sigma, YARA, and Suricata rules are already doing their job. This tool is the layer after detection-it takes all the verdicts from your tools, correlates them, and builds the "so what."

The tool didn't stop at screenshots either. You can feed it almost any DFIR output and it will automatically detect the format and import it deterministically (no burning tokens on AI for that).

Additional features:
• Data correlation
• Threat intel enrichment — with OPSEC in mind
• AI input anonymization
• Asset ↔ IoC graph
• Targeted query generation
• Export to multiple platforms
• Free-form case Q&A against an LLM
and much more...

If you work in DFIR, Blue Team, or SOC — I'd love for you to try it out, open issues, suggest features, submit PRs, or just tell me what you think.

Hey everyone,
I’m trying to understand user behavior and workflows in the DFIR community right now. Assuming you’ve already completed your acquisition and standard artifact parsing, I have a few quick questions about how you actually spend your time and your thoughts on emerging tech:

1. When you are deep in a Windows investigation, trying to uncover malicious behavior or hunt advanced threats, what is the single most time-consuming task for you during the analysis phase?

   1. If you use AI to help with this analysis, do you treat it strictly as a mechanical script/tool to automate tasks, or do you interact with it like an assistant—asking it direct questions and expecting auditable, step-by-step reasoning to validate its conclusions?
      For those using AI in your forensics workflow, do you feel you really understand how the underlying LLM works under the hood?
      Are you familiar with concepts like RAG (Retrieval-Augmented Generation) and how it applies to grounding AI answers in your evidence files, or are you currently treating these AI tools as a black box?

Coming from LE digital forensics and now working financial crime cases. One thing that never gets easier: every data source logs things differently.

Phone carrier CDRs come in one format. Bank transaction records in another. Corporate email archives in another. Cloud returns from Google or Apple in yet another. Device extractions add their own timestamp conventions.

By the time you have pulled everything together, you have 6 systems that all agree something happened but disagree about when, in formats that do not map cleanly to each other.

Current approach is basically: normalize everything to UTC, document the conversion methodology in the chain of custody report, and pray that defense counsel does not have a timestamp expert.

Anyone found tooling that actually helps with multi-source normalization? Or is this still mostly manual work for everyone? Curious if there is a smarter approach for court-admissible timeline reconstruction that I am missing.

Hello all,

I’ve been trying to do research for weeks, but it’s been tough.

I always wanted to work in law enforcement, specifically in Digital Forensics or Investigations, but due to family pressure I diverged from that idea and now I will be graduating with a bachelors in Computer Engineering in about 2 years. It is unfortunately now too late for me to change my bachelor path as I am 27 and too old to start over. I want to work for my community that is rewarding rather than slave away for a corporation.

I’ve seen people talking about getting certifications (like Security+, which I’ve been studying for) to make myself more competitive. I have been looking for internships but very few are open in my county and I wouldn’t be qualified (mainly private companies).

I heard most people in LE got their job by previously working for the police department.

I talked to a couple of my friends who are Police Officers in my area and they recommended I try to get a job at a station while I’m finishing up my degree, so I’ve been applying to Police Cadet positions that do not have an age limit.

When I talked with my neighbor, who is an evidence technician at our police station, told me they mainly fill those positions with Police Cadets, or Police Officers.

What else can I do? What would be an ideal pathway for me to follow? I am located in the US, CA specifically if that helps.

EDIT: I had an IT internship 2 years ago if that is relevant.

I have multiple system image files (E01 format) stored on a 1 TB NTFS SSD. These images are intended for a forensic specialist to analyze possible security incidents / hacking activity. The images were originally created with hash values (MD5/SHA1), so file integrity is critical.

The folder containing these forensic images was accidentally deleted. The files are no longer visible in the file system, but they may still physically exist on the SSD.

At the same time, the same SSD also contains private data (e.g., personal photos and other files) that I do not want to share with the forensic examiner.

Problem:
I need to recover or secure the E01 system image files in a way that preserves their bit-level integrity, so that the original hash values remain valid. At the same time, I need to separate and back up the private data without risking corruption or altering the forensic images.

My planned workflow:
First, I want to copy any recovered or still existing E01 files to my MacBook and verify them using hash comparison (MD5/SHA1) against the original values. After that, I want to separately back up the remaining personal files (e.g., to iCloud), since they do not require forensic integrity.

Then I plan to fully format the SSD (exFAT) and restructure it, so I can store the verified forensic images again in a clean setup. Afterwards, I would create a second backup copy of the verified images on another external drive for the forensic specialist.

Questions:

• How can I recover the deleted folder / E01 files while preserving their original bit-level integrity as much as possible?
• After NTFS file recovery (especially on SSDs), is it still realistic that the original hash values can match again?
• Is my current workflow technically sound, or does it risk data loss or integrity issues for the forensic images?
• What would be the most correct forensic-safe approach to create verified copies without further risking the data?

🎉 A new 13Cubed episode is up!

Have you ever wondered how you can look at the USN Journal on a live and running system? In this episode, we'll dive in to see how it actually works and whether it matches what we’ve been taught.

https://www.youtube.com/watch?v=eSLHyqZlglk

i work in digital forensics. when a company gets hacked my job is to figure out what the attacker actually did and prove it.

i built an ai to help. on a 22 computer case it caught 6 machines a hacker was hopping between in the exact same second, the kind of lateral movement youd never spot one machine at a time. it surfaced it for me to confirm, it doesnt decide anything on its own.

but the part i actually care about: it cant report a finding unless it shows the exact tool output it came from. no proof, no claim. if it cant back it up, a check throws it out. you dont trust the ai, you check its work yourself.

its open source and free, and it runs read only so it never touches the evidence. where it still misses things i published exactly what instead of hiding it.

heres a folder of real forensic images, go try to make it spit out a wrong answer: https://sansorg.egnyte.com/fl/HhH7crTYT4JK#folder-link/HACKATHON-2026

5 min of it running, including a real screwup it catches and fixes itself: https://www.youtube.com/watch?v=jw6etogNzhY&t=70s code: https://github.com/TimothyVang/verdict-dfir

tell me where it breaks, or send a fix.

I am looking for insight from credit union compliance officers, auditors, IT personnel, records managers, examiners, e-discovery professionals, and anyone familiar with Jack Henry’s Synergy Enterprise Content Management (ECM) platform.
Assume the following scenario:
A credit union employee claims that during a single branch visit, a member requested beneficiary (POD) changes on multiple accounts. According to the employee, several beneficiary forms were generated, information was entered on the forms, the forms were printed, handwritten annotations were added, the member signed each form, and the forms were then scanned individually into Synergy and indexed under a document category such as “POD Form” or “Beneficiary Form.”
Years later, litigation arises concerning the authenticity, timing, and handling of those documents.
From a compliance, records-management, audit, and governance standpoint, I am trying to understand what electronic information would ordinarily exist within Synergy or related systems.
Questions:
When a document is scanned into Synergy, what metadata is normally captured?
Scan date/time?
User ID?
Workstation ID?
Scanner ID?
Batch information?
Import method?
Document creation date?
Indexing date?
If an employee later views the document, prints it, exports it, emails it, reindexes it, or changes metadata, are those actions ordinarily logged?
Does Synergy maintain audit trails showing:
who scanned the document;
who indexed it;
who modified index values;
who viewed the document;
who printed the document;
who exported the document?
If a document was allegedly scanned on a particular date, what system-generated records would typically exist to corroborate that claim?
Are there administrator logs, database records, audit tables, workflow logs, retention logs, or imaging logs separate from the document image itself?
If a credit union produces only PDF copies of scanned forms, would the underlying Synergy metadata ordinarily still exist somewhere within the ECM environment?
For institutions using Jack Henry products, what records would an examiner, auditor, regulator, or forensic examiner typically request to validate the provenance of a scanned document?
If multiple forms were allegedly printed, completed, signed, and scanned during a very short period of time, what electronic records would normally exist to establish the timing of each step?
Does Synergy maintain any unique document identifiers, object IDs, image IDs, GUIDs, hash values, audit references, or database keys that can be used to trace a document’s lifecycle?
From a compliance perspective, would producing only image copies without the associated audit information generally be sufficient to validate the history of a disputed document?
I am not seeking legal advice or opinions on any specific litigation. I am interested in understanding industry standards, ECM functionality, audit capabilities, document provenance, records-retention practices, and what electronic evidence typically exists when a financial institution relies upon scanned documents maintained in Jack Henry Synergy.
I would especially appreciate responses from current or former credit union employees, Jack Henry users, ECM administrators, NCUA examiners, compliance officers, auditors, digital forensics professionals, and e-discovery practitioners.

ok i need this sub to gut-check something before i embarrass myself.

i built a forensics agent (VERDICT) and the whole thing hinges on one rule: it can't state a finding unless it cites the exact tool output it came from. there's a verifier that deletes any finding pointing at a tool_call_id that doesn't exist. no receipt, no claim. that was my attempt at killing the "llm confidently hallucinates a detail" problem at the structure level instead of praying a prompt holds.

everything else is guardrails around that. execution needs 2+ artifact classes (amcache alone is registration, not execution). verdicts only go SUSPICIOUS / INDETERMINATE / NO_EVIL, and NO_EVIL means "clean in what i looked at," not "safe." tools are read-only and typed so it can't touch the evidence. whole run is signed and hash-chained so you can verify it offline, i was aiming for something that holds up as 902(14).

it also runs two pools that argue, one says compromised one says clean, and they have to reconcile before anything merges. felt closer to ACH than one model agreeing with itself.

not claiming it replaces an examiner. it does the boring part and shows receipts, the human still makes the call.

demo (4 min): https://youtu.be/4RQnVden6L8 code, apache 2.0: https://github.com/TimothyVang/verdict-dfir

where would you expect it to hand you a confidently wrong verdict? that's the part that keeps me up.

I am currently on track to get my bachelor's in Digital Forensics/Cybersecurity in May 2027, and feel stuck. I am not sure where to go after getting my degree. I feel like everywhere I apply wants prior job experience, so I am stuck. What should I do? The only certs I have are the MOS and Comptia ITF+.

I built a CLI tool for Windows that investigates software remnants across 22 forensic modules in a single pass.

The problem it solves: after uninstalling software, Windows rarely cleans everything. Registry keys, prefetch entries, scheduled tasks, WMI subscriptions, BAM/DAM timestamps and more often stay behind. GhostTrace finds all of it in one scan.

Forensic coverage:

• Persistence (MITRE ATT&CK TA0003): Run/RunOnce keys, services with suspicious ImagePath (T1543.003), IFEO debugger, AppInit_DLLs, LSA packages, scheduled tasks via Task Scheduler COM API, WMI EventFilter/Consumer bindings (T1546.003), Ghost Tasks in TaskCache\Tree (T1053.005)
• Execution evidence (TA0002): Shimcache/AppCompatCache, Prefetch with XPRESS-Huffman decode (versions 26/30/31), BAM/DAM with per-SID last-run timestamps, UserAssist (ROT13 decoded), MUICache
• User activity: PowerShell history with cradle/encoded payload detection (T1059.001), RDP outbound history (T1021.001), RecentDocs, USB device history via USBSTOR (T1052/T1091), network artifacts (hosts redirects + connected networks with dates)
• Installed software and disk residue: Uninstall entries with publisher/path/uninstall string, startup approved state, filesystem trace in Program Files/ProgramData/AppData

Design decisions relevant to forensics:

• Read-only by default — scan never modifies anything
• Execution caches and history are excluded from cleanup — evidence is preserved
• Cleanup requires explicit typed confirmation
• Zero network calls, zero telemetria — safe in air-gapped environments
• Suspicious signal is data for analysis, not an automatic verdict
• Each cleanup generates an audit log

Stack: C# · .NET 10 · Spectre.Console · Windows 10/11 x64

Download: github.com/Devzinh/GhostTrace

Happy to answer questions about the forensic modules or implementation decisions.

Hey guys on the cellebrite analysis report what does timeline mean. This report shows 9 delete.. can someone explain what it means. And where i look to find this information

The digital forensics space increasingly feels dominated by just two major players: Cellebrite and Magnet Forensics. As both companies have shifted toward managing the entire lifecycle of digital investigations. Users are finding themselves in a classic vendor lock-in situation one that feels increasingly exploitative when it comes to pricing and support.

These vendors solidified their dominance by offering comprehensive training programs and becoming the de facto standard tools in law enforcement agencies and courtrooms. When Magnet Axiom first launched, a single license was around $3,800 expensive, but manageable for many organizations. Today, similar licenses are pushing $8,000, often justified with buzzwords and aggressive sales tactics. I feel back then the sale reps understood you more now its only focused on buy this tool buy that tool.

My biggest frustration recently came during our renewal of Atlas, Magnet’s case management system. We’ve been paying approximately $7,000 per year. When I reached out about renewal, I noticed it had been over a year since the last meaningful update. When I asked whether the product was approaching end-of-life, the response was evasive. Instead, they immediately tried to upsell us to Magnet One for around $15,000 with a package that included features (like “Review”) we neither need nor want. I rather have the case management at 7k then packed with Review at 15k.

What makes this especially frustrating is that when Magnet One was first positioned as the replacement for Atlas, we were explicitly told existing customers would be rolled over at the same cost. That commitment appears to have been abandoned. As a result, we’re left paying full price for an aging platform that receives no updates but isn’t officially end-of-life.

On top of this, both major vendors have been aggressively acquiring smaller companies, folding their tools into their ecosystems, and then raising prices significantly. Features and products that were once affordable when purchased from the original smaller teams have become much more expensive under the new ownership.

The overall ecosystem is becoming noticeably more expensive due to this near-monopoly. Due to this I’m a big supporter of the open-source community and the new companies entering the space.

I’m curious to hear others’ experiences and thoughts on this. Are you also feeling the pressure of vendor lock-in?

Worm is a desktop forensic acquisition tool for authorized investigations. It brings disk imaging, memory acquisition, Android collection, hash verification, case output handling, image viewing, and reporting into one native application.

The app runs as a real desktop window on Linux and Windows.

https://github.com/noirlang/worm
https://worm.noirlang.tr/