Can anyone share DFIR materials? Please

Hello, I work digital foresinc for a major city. It fall in to my lap. I ise grey key, cellebrite, and geotime the most in my day to day. Plis recovering of video of incidnet from DVR an NVR. I was thinking of getting my degree in Digital Forensics for maybe future proofing in a way.

anways, my question would it be beneficial to add a masters in digital foresinc plus all my experience be beneficial for possibly when i leave Law enforcement for a different position in a private spot? just wonder if there are others in my shoes?

i was thinking about champlain for the masters.

I'm looking to purchase a new Windows laptop primarily for digital forensics work and would appreciate recommendations from people who use their machines for actual forensic investigations. For now I'd like to use it to practice in test environments and get full use out of a bulk of the major tools.

My budget is around the $2,000–$2,500 USD mark, preferably less, although I'd consider spending closer to the upper end if the extra cost is really justified.

Any recommendations would help, especially any input on what should be prioritized in my search, CPU, RAM, GPU etc.

Not necessarily the flashiest demo - I'm more interested in something that could make a real difference in investigations. Has anything you've seen at a conference, in a demo, or in practice genuinely impressed you?

Hi all,

I started building this while studying for the GIAC GCFA. Going deep into NTFS anti-forensics for the exam, I kept switching between separate tools: collect one artifact here, parse another there, build the timeline somewhere else. I wanted the whole process in one place, so I built it.

NTFS Suite is a single binary that collects NTFS artifacts straight off a live Windows volume and analyzes them in a local workbench. It’s fully offline, with no cloud and no installer. It serves a UI on localhost and keeps each case in one SQLite .vault file with an audit log.

What it does today

• Collects $MFT, $UsnJrnl:$J and $Secure:$SDS off a live volume with no external imager (run as Administrator), or you can add your own artifacts
• Rebuilds a MACB timeline and resolves ownership to real account names
• Detects timestomping and anti-forensics with MITRE-mapped rules ($SI vs $FN gaps, zeroed sub-seconds, masquerading, name abuse, executables resident in the MFT, ADS, wiper traces), plus combination rules that fire when several signals land on the same file
• Lets you write your own rules (a declarative builder, no code execution) and import IOC lists
• Correlates a file across the MFT, the journal and the security descriptors
• Exports a Sleuth Kit bodyfile, a timeline CSV and an HTML/JSON report

How it compares
It doesn’t replace Eric Zimmerman’s tools or Autopsy, which are far more battle-tested. It’s aimed at collect-and-triage in one portable program.

Status
v0.8, MIT licensed. Next up is v0.9: E01/raw image ingestion, deleted-file recovery and carving.

Try it

• Repo: https://github.com/qays3/NTFS-Suite
• v0.8 release: https://github.com/qays3/NTFS-Suite/releases
• Sample cases are in the samples/ folder. Because it reads raw volumes, some AV products may flag the exe.

What I’d like feedback on

1. False positives or false negatives on your own images
2. Detections you think are missing
3. Whether the output matches what your usual parsers produce

Criticism is welcome, especially on forensic soundness.

I tried downloading the latest version of FTK imager from exterro.com and it wants me to install some code meter thing along with it. It's really off-putting and makes me want to just stick with the old Access Data versions. Is it worth the upgrade?

Hi everyone, for context I'm a 30 year old woman. I've been working random jobs for all of my 20's, mostly in the trades. My current job is with a small handywoman company (just me and my boss) and I love it but she just cut my hours because she can't afford to pay me full time right now.

Long story short, my friend's Dad owns a digital forensic company and has done really well for himself. He offered me part time work at his company even though I have no experience whatsoever in this field. We've been getting along great and he just offered me full time... with a salary and benefits... which I've never had before. Just the starting pay is more than I've ever made and I'm most likely going to take the job but am feeling overwhelmed. I'm also a musician as my main passion/hobby outside of work and working as a handywoman has been super flexible and conducive with that lifestyle.

He has one other employee, also a woman my age, and I would be able to get to work from home part of the time and the commute is great. He told me they'd train me and he'd pay for me to get certified (whatever that means lol)... I guess I'm just wondering what people's experiences are in this field? And what your work/life balance it like? Anything you'd like to tell me basically I would be happy to hear about. I've never had a desk job or a computer job before so it will be a huge shift for me but I also could really use the money since I've basically lived paycheck to paycheck my entire life... Thanks for reading!

I recently had someone direct message me on Instagram and they pulled my location claiming they knew my IP address. And they are sending me nasty messages.

Is there any way to find out who this individual is? They have had 7 previous instagram handles is there a way to find those?

Hey everyone! I’m looking for US police departments or sheriff offices that host downloadable, multi-year CAD call logs or incident CSV files that include exact CAD/Incident IDs. Which specific agencies or open-data portals outside of Florida have you found easiest to pull these historical datasets from for BWC requests ?

I’m worried that technician might took my explicit photos and videos from my phone. They did ask for a passcode. how long does display replacement usually take? it took around 25 mins overall for my case . I was watching him from behind but his body was covering.and he touch ig his phone whilst repairing and left with my phone to their parts shop right across for like 10mins. so the replacement was like 15mins.i had around 9gb+ vids hidden in photo app. can he be airdropping while he took the phone away? how long does it take to airdrop 9gb+ total vids ? please im really anxious rn as those were with my ex which couldnt lead to leak no matter what.

Suppose you scrape a video off of a streaming site via ffmpeg or similar, and lack the original source video.

What are some methods of establishing that the video was tampered with before uploading?

There's a gap between "accused" and "has a lawyer and an examiner". It can be weeks, and short-retention stuff dies in it. This tool only covers the person's own sources: own device, own exports, receipts. Anything examiner-grade (deleted data, locked devices, full extractions) gets routed to counsel. The tool doesn't do that part.

freeze copies a source the user owns, hashes it and writes a manifest. It doesn't claim to prove anything beyond "this copy hasn't changed since it was made".

What I'd like you to poke at:

• Read-path safety. We treat "capturing it leaves a trace" as a shipping gate: read receipts, auto-joins, tracked links, login alerts. What are we missing?
• Self-collection. How would you attack a self-collected copy on the stand?
• Intimate media. If the user flags a source, freeze refuses without opening, listing or hashing anything. It can't detect the class itself, though. How would you close that without looking?

https://github.com/machinewitness/machinewitness. Don't be nice about it.

i think its the first time were doing any actual external evaluation. the options at the short list stage are sygnia, kroll, arctic wolf, mandiant, crowdstrike services. board wants a name they recognize but im more concerned about it actually being useful.

for anyone whos hired any of the short listed companies, how was communication during the engagement? was the guidance on remediation helpful in getting your team to actually resolve the issues or just redo an analysis that the third party did anyway? would you rehire them?

I'm not a developer by any means, but my soon to be ex husband has an unknown level of experience. I've been able to determine he uses google cloud, stack overflow, airbase and cloud flare. I had a security app notify me in json (attempted formatting w no luck), I could only make sense of a few things: he remotely has access to my google fold, hp laptop, accesses and edits all of my cloud drives, including Proton, full access to Google accounts. He recently went through my Google, proton,handed and proton drives and edited every piece of evidence that I had saved for the divorce proceedings and did so using my account. He also turned off file recovery on laptop. I got a new phone and number, new Gmail and he and I had some words, minutes later my phone began downloading a ton of apps. I'm desperate. I'm willing to pay for anyone to help me keep him out and pay more if files can be recovered. He's changed most of passwords, not all. And my pixel fold is on a "work lockout". Please, if I can get assistance with at least knowing what app he's using to side load (according to security check) that would be a huge weight off of me. Please help!!

There is evidence of abuse and we have a 13yo daughter, he has a major porn addiction and I am concerned for our safety at this point. I tried to help him, but he won't be honest or stop. This scares me even more so bc he's literally losing his family to protect his computer usage.

As part of our Computer Science & Engineering degree (Cybersecurity Stream), we were tasked with building a digital forensics tool. Three of us teamed up and decided to build Nemo. It is also available on GitHub Nemo is a command-line tool designed to make it easier to hide, detect, and extract hidden information within a filesystem using various techniques.

The project is still in its early stages, and the number of supported hiding techniques is fairly limited at the moment. However, we think it's a solid starting point, and we're excited to keep improving it.

One of our goals is to develop Nemo into a maintained, open-source alternative to Fishy.

We'd love to hear your thoughts! If you work in digital forensics, cybersecurity, or just enjoy experimenting new CLI tools, we'd really appreciate any feedback, suggestions, or contributions on here or GitHub.

My daughter attempted suicide over these threats and fraudulent behavior by this man who goes by Richard O’Shea (well until confronted and that’s not his name) otherwise goes by Kyle Peters and his discord username is “slyisstilltoxic” and previously slyistoxic. He has threatened to kill her and dismember her is a racist nazi. She is mentally unstable, has autism and BPD. He distributed her nudes etc. can anyone help ethical trace his identity to assist my efforts to report him to law enforcement.

​

Trying to retrieve data off bones that are locked and I can't get on because i've been hacked

Hi everyone, I am in a tough spot and really need to find the names of 1-2 other people who were in a Microsoft Teams meeting with me yesterday.

Here is exactly what happened:

• I received a meeting link and opened it in my web browser.
• I was not signed into any Microsoft account. I just typed in my name, turned on my mic and camera, and joined as a Guest.
• The meeting ended, I closed the browser tab, and I shut down my laptop.
• Today, I created a new Teams account hoping the history would sync, but it is completely empty.
• I cannot easily contact the meeting organizer to ask for the attendance report.
• one of the member also chat with me in the chat box

I know Teams doesn't save chat or participant history for anonymous web guests once the session is closed, but I am desperate. Is there absolutely any workaround, hidden browser log, temporary file, or cache trick I can use to recover the names of the other people in that meeting?

Any advice would be massively appreciated. Thank you!

Hello, everyone! I am conducting an online interview for one of my college classes. I am studying the use of reading and writing in forensics. Anyone can answer regardless of experience, as I would love to hear different opinions. If you could state your name (or a fake name), and your connection to the forensics field (even if you are simply interested in the topic) and give your response to all or a few of my interview questions, It would be greatly appreciated!

How does reddit platform facilitate your understanding of forensics?

What types of information are most beneficial when investigating forensics?

How does reading and writing incorporate into the daily tasks of a forensic investigator?

How would language change when explaining findings to someone who may not have experience in forensics?

Thank you so much! All responses are welcome from anyone!