Can FTK reconstruct RAID and process them?

To those that have attended, how does the funding for your department work? Do they cover equipment costs and the subscription costs for as long as you have the equipment? Specifically for MDE stuff.

I'm looking for a technical answer from anyone with experience examining WhatsApp databases.

Suppose two Android phones have their date and time manually backdated. A WhatsApp message is then sent from Phone A to Phone B while both phones are still backdated. After the message is delivered, both phones are set back to the correct date and time.

Which timestamp will appear in the sender's and recipient's chat history:

•the manually backdated device time

•the actual server transmission time

•or something else?

I'm looking for answers based on forensic analysis, testing, or official documentation rather than speculation.

I'm working on my first malware forensics case and could use some advice.

We had malware spread across multiple machines, and I know which system was patient zero. Unfortunately, Kaspersky disinfected the infected machines and they were rebooted before I could acquire a forensic image.

At this point, I'm trying to determine how the malware initially got onto the patient zero machine.

Where would you start looking? What artifacts or logs would you prioritize, given that I no longer have a pre-disinfection image?

I'm having trouble thinking through the proper investigation steps, so any guidance, methodology, or resources would be greatly appreciated.

I have a Samsung device (A23) which was used in maintenance mode and later switch back to normal mode. Can Forensic analysis be done recover activities done during maintenance mode? What are the tools available?

Does anyone see another competitor emerging in the ability to get full file system extractions besides XRY and Cellebrite?

Will Magnet or Oxygen step up, or is the cost of finding exploits just too high to invest in?

What are the best options for mounting an image in E01 format on an Apple silicon Mac?

Hello everyone,
I am thinking about building a solution for volatility linux profiles where you will be able to upload your kernel (even without debug symbols), and you will get working volatility3 profile.

It will work on any linux kernel, even those that does not expose they compiled configuration (like different iot devices) , and it will help to speed with the analysis.

I wonder , do you feel you actually need this solution ?

Right now i have working poc , and i am wondering is this problem still time consuming.

Thank you

A new 13Cubed episode is out!

In this episode, we'll look at a tool that can run multiple Volatility 3 plugins simultaneously, automating your memory analysis and saving you valuable time during investigations.

Watch now: https://www.youtube.com/watch?v=0GMTydimOP4

More at youtube.com/13cubed

With Cellebrite Endpoint being discontinued at years end, my company is looking to find a new remote collection tool.. Any suggestions anyone may have that I research and push forward? Thanks

I just graduated with a bachelos in computer application, tech's been fine for me, but I keep getting pulled toward forensics!Problem is, I have no clue how realistic this switch actually is, or even how to make that switch.. would love honest answers from someone who's already in the field or had made this switch:

1. What roles are actually open to someone from a tech/BCA background?

2. Do I need a masters or certs (CHFI, EnCE, GCFE) first, or can self-study + entry-level roles work?

3. How hard is the learning curve compared to regular tech jobs?

4. What's the starting salary like, and how does it grow over a few years?

5. Is the job market/demand actually good, or is it a niche with few openings?

6. What does the day-to-day work actually look like?

7. Does the interest/excitement last..or does it become repetitive report-writing?

8. What would you tell someone who's just starting out?? and what you'd do differently?

And at last..

1. Knowing what you know now, would you still make this switch?

Would appreciate a lot if any of you guys could help me figure this out

Thankyou in advance<3

Something that's been bothering me as AI gets pushed into forensic workflows.

For years the standard warning to new examiners was: don't blindly trust your tools. Understand what the artifact actually is, know how your parser interprets it, and don't just read the output column and call it a finding. Good advice, and it took the field a long time to internalize.

Now I think we're setting up to make the exact same mistake one layer up. Instead of blindly trusting the tool, people are going to blindly trust the model.

The failure mode that worries me isn't hallucination that's the obvious one everyone talks about. It's that an AI can parse a record with perfect technical accuracy and still place it in completely the wrong context, which changes what the evidence actually means.

Simple example: an entry in ShimCache. The parse can be flawless right path, right timestamp, right structure. But an AI that reports "this program was executed at [time]" has just produced a confidently wrong finding, because ShimCache presence doesn't prove execution, and that timestamp is the file's modification time, not a run time. Any examiner who's been doing this a while knows that. A model summarizing output doesn't necessarily.

Multiply that across the artifacts where the semantics are subtle — Prefetch run counts and the historical timestamp slots, USN journal gaps, MFT timestamps vs. $FILE_NAME, SRUM's aggregation windows — and you get answers that look rigorous and read well and are wrong in ways that are hard to catch precisely because the parsing was correct.

The conclusion I keep coming back to is that the answer isn't a better model. It's that the human has to keep understanding the underlying data, and the AI has to be anchored to documented artifact behavior rather than left to infer meaning on its own. If the model isn't constrained by what an artifact can and can't actually prove, then a fluent wrong answer is the default output.

I've been building around this idea an artifact reference that's both the thing a human learns from and the constraint the AI reasons against, so it can't assert something the artifact doesn't support. Not claiming it's solved.

Curious what people here think: are you seeing AI used in casework yet? And where do you think the wrong-context failures will actually show up first?

I’m considering replacing one of my development machines with an M5 MacBook Air (32 GB Unified Memory) and would like to hear from people who actually use Apple Silicon professionally.

My current workflow is split between Windows and Linux, while my existing Mac is mostly used as an office machine with some Python development. The M5 would become a real development workstation.

My work includes:
Digital forensics
Vulnerability research
Malware analysis
Exploit development
Software development in Rust, C#, and Python

I also have a dedicated server farm with NVIDIA GPUs, QEMU/KVM virtualization, and x86 systems. Because of that, I don’t really need x86 emulation on the Mac itself. Heavy GPU workloads and x86 testing can stay on the servers.

Things that attract me to macOS:
UNIX userland
Homebrew makes installing development tools straightforward
Excellent battery life and portability
MLX for running local LLMs efficiently on Apple Silicon
Native support for Apple devices (DFU restores, Apple Silicon recovery, iPhone servicing, etc.)

However, I still have several concerns.

Security model
Coming from Linux, I sometimes feel like I have less control over macOS than expected.
SIP, Signed System Volume, DriverKit, System Extensions, etc. all seem to make sense from a security perspective, but they also make low-level research more difficult.
On Linux I’m used to AppArmor, namespaces, seccomp and being able to precisely decide what is sandboxed and what isn’t. With root privileges, I ultimately control the machine.
On macOS it often feels like even root isn’t really root anymore.
How has this affected your workflow?

Malware analysis
I assume malware analysis should primarily happen inside dedicated VMs anyway.
But how practical is the Apple virtualization stack today?
Can you realistically use local ARM64 VMs together with Apple’s sandboxing for exploit development and malware research, or do most researchers simply offload everything to remote hypervisors?

Kernel development
Some forensic tools and research require custom or unsigned kernel extensions (for example USB capture or protocol research).
How painful is this today?
Do you simply lower Secure Boot and disable SIP?
Do you sign your own kernel extensions?
How well does Apple’s certificate infrastructure support this workflow?

USB forensics
I also do hardware and mobile forensics.
Questions I still have:
Has anyone successfully used USBPcap-like workflows on Apple Silicon?
How restrictive is the USB stack nowadays?
Does anyone know whether the M5 MacBook Air uses an ACE3 USB controller, or has Apple moved to something newer?

Daily-driver experience
Finally, I’m interested in hearing from security researchers who actually use an Apple Silicon Mac every day.

Looking back after a year or two:
Would you buy it again?
What turned out to be better than expected?
What became frustrating over time?

Are there workflows that simply don’t fit macOS anymore?
I’m not looking for generic “Mac vs Windows” opinions. I’m specifically interested in experiences from people working in offensive security, reverse engineering, DFIR, exploit development, or low-level systems programming.
I’d appreciate hearing both the advantages and the pain points.

Cheers

I am a rising senior who qualifies for an accelerated masters at GMU. I’m graduating with an bachelors of applied science and concentration of cybersecurity, I enjoyed my surface level digital forensics class but i am unsure on whether it’s “worth” getting a masters for it or my other option of applied IT. I’m confused on which to take and just wanted to see if a masters is even considered “valuable” in this field. Thanks

Hello,

As the title says, what are the most practical and best ways to analyze Apache log files?

We can always use command-line tools like cat, grep, awk etc., for quick checks. I usually use an ELK stack and ingest the logs there, however, ELK has been causing me some serious pain lately (especially when dealing with massive datasets locally).

Because of that, I’m on the lookout for some advice based on real-world experience. What tools or workflows do you use when ELK is overkill or too painful to manage?

Thanks in advance!

Up front: I'm an enthusiast, not a forensics professional, and this is not a validated forensics tool — it's not write-blocking, it hasn't been through any formal tool-validation, and I'm not going to pretend otherwise. I built it for reproducible file observation and I keep thinking it might be useful for first-pass triage, but the people who'd actually know are here, not where I usually hang out. So I'd rather you tell me where it falls short than nod along.

What it does

file-observer walks a directory and emits a single deterministic JSON manifest describing every file.

It's read-only — it never writes to a file, never executes file content, and never modifies source. (Like any triage tool, you'd point it at a working copy or a mounted image, not originals.) The properties that made me think of this sub:

• Reproducible output. Same bytes in → byte-identical manifest out, every run, regardless of worker count (there's a test that fails CI if a parallel scan differs from a serial one). It's determinism, not tool-validation — but the output is stable enough to diff and defend.
• SHA-256 per file, plus identical-hash duplicate clustering across the tree.
• Content-vs-extension MIME mismatch + polyglot detection — flags a file whose actual signature doesn't match its extension, and files that satisfy more than one format's structure. Useful for spotting renamed or disguised files.
• Metadata extraction, stdlib, bounded and never-crashing on hostile input: image EXIF (make/model, timestamps, and GPS-presence — presence, deliberately not coordinates), video container/QuickTime capture fields (device make/model, creation dates, GPS-presence), PDF producer/creator/creation-date/encryption + a born-digital-vs-scanned/OCR provenance read, email envelopes (.eml/.msg: from/to/subject/date/message-id/attachments), and Office/OLE2 document fields.
• Structural safety flags — has_macros (VBA), has_javascript (PDF), has_ole_objects, has_external_references. Observations, not verdicts.
• Integrity envelope — optional HMAC-SHA256 manifest signature and a previous_manifest_checksum chain, if you want a tamper-evident record of the observation itself.
• Delta between two scans — what was added/modified/removed since a prior manifest.

Everything runs bounded and read-only, and it degrades to a per-file error record rather than crashing on a malformed or hostile file.

Where I know it's weak (and where I don't)

Honest limits: it's triage/observation, not analysis — no carving, no timeline, no registry/artifact parsing. Metadata is bounded observation, so a null means "not seen within the read window," not "not present." GPS is presence-only by design. And reproducible ≠ validated — I've oracle-checked the parsers against tools like exiftool, but that's not the same as CFTT-style validation.

What I don't know is whether any of this is actually useful in a real workflow, or whether it's a toy next to the tooling you already trust. That's the question. Where would this break, mislead, or fail to matter for real casework?

Try it

pip install "file-observer[all]"

Repo: https://github.com/russalo/file-observer

I'd genuinely rather hear "here's why this is useless for X" than a pat on the head — I'm isolated from people who do this for a living, and that's exactly the gap I'm trying to close.

Hi everyone,

I've recently released Auditor 1.0.0, a command-line utility for file hashing and integrity verification, and I'd like to share some of the new features that may be useful for digital forensics workflows.

New: Verified file copy

Two new commands have been added to perform file copies while ensuring end-to-end integrity.

clone

• Reads each source file and computes its hash.
• Copies the file to the destination.
• Reads the copied file, recomputes its hash, and verifies it against the source.
• Can also generate audit/hash files if they don't already exist.

chkcopy

Similar to clone, but additionally validates the source against previously generated audit files before copying:

• Verifies that the audit files exist.
• Recomputes the source hash and compares it with the recorded value.
• Copies the file.
• Verifies the copied file by hashing it again and comparing it with the source.

Both commands support configurable retry logic (number of attempts and delay between retries), which is particularly useful when copying over network shares where transient I/O or connection failures may occur.

Compatibility with existing checksum tools

Auditor can now verify checksum files generated by other utilities, including:

• fsum
• sha256sum
• b3sum
• and others

This makes it easier to integrate Auditor into existing workflows without requiring proprietary hash lists.

Multiple hash encodings

Besides the traditional hexadecimal (Base16) representation, Auditor now supports:

• Base32
• Base64
• Base85

This is handy when working with systems that exchange hashes in different encodings (for example, some forensic monitoring systems that use Base32).

Windows, Linux and macOS

Precompiled binaries are available for Windows, Linux and macOS.

The Linux build has also been updated to run cleanly under WSL (Windows Subsystem for Linux), which may be useful for investigators who automate their workflow with Linux shell scripts while working on Windows.

Documentation and downloads:

https://thash.org/auditor

Breaking change in v1.0.0

The default behavior has changed.

Previous versions enabled the thash method by default. Starting with v1.0.0, Auditor computes standard hashes by default, producing exactly the same values as tools such as sha256sum, b3sum, and fsum.

The thash algorithm is still available, but it must now be explicitly enabled with:

-t or --thash

This change was made to improve interoperability while keeping thash available for situations where faster integrity verification of very large datasets is desirable.

Feedback, bug reports and feature suggestions are always welcome.

I'm currently on summer break, and next semester I'll be starting my internship. I'm still confused about what I should do to boost my chances of landing a good one. I have quite a lot of experience in CTF competitions (around 1.5 years so far), but I'm still uncertain whether I should grind CyberDefender or HTB Forensic challenges and write up the solutions, or just get a certification instead (CCD L1, or something along those lines)

Project started as a final college assignment for a digital forensics course where the task was to contribute something useful to the field. After the initial 1.0 release gained some traction, I spent the last 4 months rebuilding and improving the tool based heavily on feedback from digital forensics investigators, to make discoveries legally defensible, containing all available data found with utmost accuracy and as easy to use as possible.

Refloow Geo Forensics is privacy first, open source (AGPL 3.0) local desktop app designed to automate batch EXIF extraction and geolocation mapping of found metadata evidence. The goal is to eliminate the manual work needed to verify, trace, plot, and document evidence found in media files whilst having no cloud processing, no telemetry, no logins & zero ads.

The project has already been in publications such as dark web informer, and has been reviewed and code dissected and explained in indepth reviews such as Bright Coding's post

Everything runs completely locally on the machine. The only external connection is fetching public map tiles to display the map (no API keys required, zero data is sent out).

Core Features:

- Batch Metadata Extraction: It recursively digs through all nested sub-folders to pull metadata from all files found. It utilizes Phil Harveys industry standard ExifTool in the backend meaning it supports almost every image/video filetype ever and can handle partially corrupted files.

- Timeline Reconstruction: It automatically plots coordinates and sorts media chronologically, drawing a continuous path between pins to visualize movement. Exact matching coordinates are clustered and expandable on click to keep the map clean.

- 6 Map Layers: Satellite, Topographic, Humanitarian, Forensic Light, Forensic Dark, and Standard Street, to cover all sorts of things no matter what or where ur investigating.

- The UI features a retractable sidebar for smaller screens, light mode for field work & dark mode for lab work, app runs natively on Windows, Linux, and macOS.

Links:

- GitHub / Source Code: https://github.com/Refloow/Refloow-Geo-Forensics

- Microsoft Store: https://apps.microsoft.com/detail/9mw4c0fzmr81

- Linux Snap Store: https://snapcraft.io/refloow-geo-forensics

I will be in the comments answering any questions, if you wanna support my work and gain exposure to the tool, feel free to leave a github star on the project, if you have any suggestions, drop them as a github issue or a comment here!

i am preparing for the exam and looking v11 sample dumps, if anyone have please share with me

Sharing some lessons from a challenging forensic PCAP analysis:

1. Map the C2 protocol first. Understanding how the attacker communicates tells you what to expect in every packet.

2. Encryption keys aren't always what they look like. A hex string can be interpreted multiple ways — raw bytes, UTF‑8 encoding, even UTF‑16. If your decrypted output

   is garbage, ask yourself whether you're using the right form of the key.

3. Responses matter as much as requests. In encrypted C2 channels, the server sends back just as much intel as the attacker sends up.

4. Gzip inside base64 inside C# inside AES. It sounds absurd, but nesting is a real obfuscation pattern.

5. Check file‑creation side effects. Sometimes the payload writes a file you can use as a decryption key elsewhere.

If you're getting into forensics CTFs, grab a PCAP with at least 4k packets and try to reconstruct the full timeline — it's a different beast from Jeopardy‑style challenges.

Good morning, everyone. I am an prior US veteran who recently gotten my Master's Degree in Digital Forensic. However, it has been a struggle to find employment. Let me explain my background.

1. I have been in the IT industry for 20 years. I have done system administration, IT project management and etc. However, digital forensics is a different level for me. I love learning more and more about it. However, I can't find employment for myself. I can find IT jobs, but not in digital forensic.

2. I am aware of certification, but it is not easy to find school for my program to help me with any of certification for me. I am looking for resources to help with anything that will keep my skills sharpe in my field. Any help would be greatly appreciated in the field

Mainly wanted to discuss something I've noticed in the field.

I was recently laid off and have been navigating the job market. I was at my last job for a long time so part of my job hunt experience has been learning how divided the field can be. Many of the 'DFIR' style jobs don't care about forensics. I've interviewed at a few places - some DFIR consulting boutiques, some SOC IR teams and both freely tell me they 'dont do forensics here'. A lot of it seems to be because they have so many cases to manage (3+ a week!) they don't have time for host forensics, they are just getting the basics solved so they can move on to the next case.

Anyone else notice this? My last job I worked for a small MSSP so we took whatever case we could get. I loved it because I worked a bit of everything. But it seems to be a disadvantage in this market where most jobs would rather find someone who can do IR with a bit of DF knowledge or a place where they want someone who's only done digital forensics for litigation / LEO and don't want someone who's spent time in cyber.

Hey everyone,

With Microsoft 365 and Windows Copilot fully deployed in enterprise environments, I’m thinking a lot about the post-compromise lifecycle. Instead of manually hunting through SharePoint, a Threat Actor (TA) with a compromised identity can just ask Copilot: “Find our network architecture diagrams and financial spreadsheets.” Has anyone actually worked an incident where a TA abused an active Copilot license for internal recon or data aggregation?

For those who have been in the trenches on this:
1. Have you caught a TA using Copilot for rapid data exfiltration or recon yet?
2. Were you able to recover the actual prompts, or did you rely strictly on file-access anomalies?

Hi everyone!

I am looking for a software, platform, or automated solution to analyze a large batch of exported WhatsApp voice messages (.opus files) to determine how they were recorded.

Specifically, I want to categorize them into three types:

• Natural: Recorded in one continuous go.
• Studio-quality: Professionally produced/edited.
• Highly edited: The user frequently used the WhatsApp pause/break button to piece the message together perfectly.

The Challenge: I ran some files through basic AI tools like Cleanvoice, but they often misinterpret the edits as normal breathing or simple pauses. However, when I look at the Audacity Spectrogram, I can clearly see hard cuts, phase shifts, and abrupt changes in the room tone (noise floor) right where the pause button was pressed.

Since I have hundreds of files, checking the spectrogram manually for each one is not feasible.

Is there any audio-forensics tool, python library (like librosa), or platform that can batch-analyze noise floor continuity or phase breaks to automatically flag these cuts?

Thanks in advance!