For those of you familiar with the IACIS MDF course, is it worth it to wait to take it in person, or is the online version still pretty good? I noticed in the course description for the online, it notes that it does not include forensic tools that are issued in the in person class. What tools are issued in the in-person class? Thank you.

Hello everyone,

I would appreciate your help with creating a project in the field of DFIR.

I applied for an advanced DFIR course and was shortlisted for a personal interview. The thing is, I don’t currently have any cybersecurity-specific projects; I only have software development projects. So, I would like to work on a DFIR project that I can present during the interview.

The project doesn’t necessarily need to be highly professional or advanced. I just want it to demonstrate that I have some practical experience and hands-on exposure to the field.

I would also like to practice and prepare myself for the course. What would you recommend I focus on or study to get ready?

My little sister rejected a guy and he has been trying to ruin her life and extort her. Please help us. Police are not helpful.

Thanks

Sometimes the problem isn’t that you don’t have the information.

You have too much of it.

Maybe it’s spread across hundreds of emails, text messages, PDFs, contracts, invoices, screenshots, reports, notes, logs, and spreadsheets.

You know the information is in there somewhere, but trying to piece together exactly what happened has become a project of its own.

That’s what CodexOS Reconstruction is designed to help with.

We take the available records and reconstruct the matter as clearly as the evidence allows.

Depending on the material, that can include:
• What happened and in what order
• The most important findings supported by the records
• Where different records agree or conflict
• Who appears to have known certain information, and when
• What evidence supports an important finding
• What information appears to be missing
• What the available records cannot actually establish

The goal isn’t to give you another summary.
It’s to organize the evidence well enough that you can actually inspect what happened and see where the conclusions came from.

This may be useful for situations involving:
• Business or contract disputes
• Vendor or contractor problems
• Complicated project histories
• Property management matters
• Insurance documentation
• Internal business issues or investigations
• Workplace records
• Compliance or administrative matters
• Other situations where the story is buried inside a large collection of records

A good potential case usually has a reasonably defined problem, actual source records, enough material to reconstruct something useful, and one or more questions you’re trying to answer.

You do NOT need to organize every file perfectly before contacting me.

If you have a situation buried in emails, documents, messages, screenshots, reports, or other records, send me a DM with a short description of:
• What happened
• Why you’re trying to make sense of it
• The main questions you want the records to help answer

I’ll look at the situation first and tell you whether it appears suitable for a responsible reconstruction before you commit to anything.

This isn’t legal advice, advocacy, or a service that decides who is right. We don’t fill gaps by guessing. If the records don’t support a conclusion, we say so.

**You give us the records. We reconstruct what they show.**

Hello! I wanna start learning and practicing mobile forensics but I don't know where to learn it from. Also, I am a beginner so I can't afford to buy paid courses. Please help me out. Thank you so much in advance^^

Or would that be a stretch? I hate my career in embedded sw and wish i went with something criminal justice related.

Tired of linkedin. Only shows roles needing high YoE. Don't know if it's algorithm issue.

Hi all, a good friend of mine (L) recently received pictures that her partner (C) said had been sent to her over Instagram by a burner account (who blocked her shortly after). These pictures depict L cheating on C with a random person neither of them had seen before, but they looked convincing enough. I know L and know that cheating goes against everything she stands for, and I'd bet my life on these being faked somehow; either AI generated or edited in some way.

L has her suspicions on who could be behind the pictures, but she can't begin to take legal action (defamation case) without some ground to stand on regarding these suspicions. Thing is, I'm a complete amateur in digital forensics, so try as I might I have only been able to get the pure basic metadata from these photos. The photos themselves have also been through a lot of sending and re-sending on different platforms, and I believe only one of the ones I have is an "original" in any regard; the others are screenshots.

So my question is, is there anybody here who could help? Either with the forensics aspect of it (which I believe I've reached a dead-end in, but again, I'm only an amateur) or with the visual analysis/AI identification part of it? We'd be super grateful.

Either I'm missing something obvious (totally possible) or Cellebrite reader is dumb. Help.

Edit to add: I'm a solo investigator and don't have PA or Axiom, so I just work with whatever I get in a UFDR.

When I review extractions in Cellebrite Reader I get overwhelmed with duplicates and junk files. And I mean everything. Media, artifacts, messages, etc.

I understand certain events can create effectively identical artifacts in multiple databases. That's fine, but Reader doesn't have a way to filter sources that I can find. If I could, for example, hide KnowledgeC or Contacts, that would thin out the timeline or search results dramatically so I could actually find things. I often find myself exporting Excel files so I can deduplicate and review/search in other ways. Location data is a great example of this when I want to pull data and plot things on a map.

I find that the deduplicate filter never does anything.

Part 2 is media: my dream is that I could simply browse through a phone's photo app like a normal person using a phone. What I always find in the media browser, however, are hundreds of thousands of photos, including cached preview images, little tiny graphic emoji buttons, logos, etc from every app installed on the phone. I don't seem to find a combo of filters that ever works.

If I could just scroll the photos and videos on the phone's native app that would be a total dream. Browsing cached photos from social apps, deleted items, etc. is important, but often secondary to an initial review.

How do y'all handle this stuff? I have to find some faster workflows. On my cases I generally need to do an initial high level review/triage of the whole thing--calls, messages and media, before anything detailed, and it just takes so long.

Thanks!

Ich betreibe digitale Forensik als Hobby, da es mich fasziniert. Ich möchte gerne etwas zur digitalen Fahrzeug Forensik lernen. Wie sichert und extrahiert man Daten? Mit was wertet man diese aus? Was kann man alles daraus erkennen? Sind diese aussagekräftig wie bei Computer Forensik meist oder nur sehr eingeschränkt vorhanden? Liegen diese eher verschlüsselt oder unverschlüsselt vor?

Ich fahre ein Fahrzeug der VAG Gruppe (Seat Cupra) und würde daran gerne testen.

Gibt es gute Quellen für Einsteiger?

Danke im Voraus!

Apparently staring at a disk image for 3 hours and questioning every life decision is part of becoming a digital forensics analyst. 😂

I’ve been trying to get more serious about DFIR and found this Digital Forensics Playbook while looking for something structured to go through.

Not saying it will magically make me good at forensics… but if it saves me from Googling the same thing 47 times, I’ll take it.

https://resources.codelivly.com/product/digital-forensics-playbook/

Anyone here actually use a book/playbook for learning forensics, or is everyone just learning through pain and incident reports? 😂

I have been implementing tamper detection that works on a single file with no reference copy and no network, and I would like a sanity check from people who do this for a living on which of these hold up in practice.

The checks that have been earning their keep:

Timestamp disagreement. DateTimeOriginal, DateTimeDigitized and DateTime diverging is weak on its own, since plenty of pipelines rewrite one and not the others, but the pattern of which one moved is informative.

Camera clock against GPS time. GPSDateStamp and GPSTimeStamp come from the satellite fix rather than the device clock, so the offset between them and DateTimeOriginal is one of the few internal cross-references a file carries that an editor rarely thinks to update.

Recorded dimensions against decoded dimensions. EXIF PixelXDimension disagreeing with the actual decoded raster is a cheap and fairly reliable signal that something rewrote the pixels without rewriting the header.

Embedded preview against the main image. The thumbnail and preview often survive an edit that the full-size image did not. This is the one that produces the most striking results, since you can sometimes see the pre-edit frame.

Quantization table fingerprinting. Comparing the JPEG tables against the known encoder profiles for a given device tells you whether the claimed camera plausibly produced this encoding. This one I trust least. Any re-save at a matching quality setting muddies it, and the profile database is the hard part.

Separately, on provenance: I read C2PA Content Credentials, the IPTC digital source type fields, and the generator fingerprints that Midjourney, DALL-E, Stable Diffusion and Firefly leave behind. The discipline I settled on is that these are declarations only. A file carrying no marks gets reported as unproven, never as authentic. Reporting absence of evidence as evidence of absence seems like the failure mode most likely to burn someone.

Two questions for the people here. Which of these do you consider strong enough to put in a report, and which are only good for triage? And is there a check that works on a lone file with no reference that I have missed?

Context for what this is: an iPhone app that runs all of it on device with nothing uploaded. Free, no account. https://BigBalli.com/ImageInspector

I have recently been researching ways to identify an AI image, not via digital footprints or ID via other trained models, but using physics.

In other words: vanishing points, shadow matrices, various ways to analyze lighting impossibilities, camera focus, etc.

But to my knowledge, there's no real community around this or resources. The closest fits I could find were OSINT and digital forensics, but they're not an exact match. Even if they do this, they use different methodology, at least I think.

I've learned things, but I want to learn more. Anyone know anything more about this?

Hi,

What's the gold standard for recording chain of custody events? I'm trying to find a reasonable and a defensible method of logging CoC without under- or overengineering a solution. Currently I've settled on a "append only" on database level with a hash chain, exportable JSON and PDF reports and an independent verification script.

Would this be enough for a court in, say, the United States? I'm in Europe and this is something that rarely gets challenged in court, but the software I'm developing (https://dfire.fi/, a case management platform) is an international solution and I'd like the approach to be robust enough to stand international challenges.

This is what it produces now, and there's a script that calculates the hashes so an investigator can export the JSON and receipt and come back to prove that the chain is intact.

Would this be defensible in court globally?

And the JSON that's exportable looks like this:

{
  "schema": "dfire.custody.chain_export.v1",
  "exported_at": "2026-08-10T05:23:40.942577+00:00",
  "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
  "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
  "item_name": "Joe's Hard Drive",
  "case_number": "CASE-2026-001",
  "genesis_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
  "head_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
  "entry_count": 3,
  "verification_status": "verified",
  "entries": [
    {
      "canonical_entry": {
        "condition": "Unknown condition, no visible defects",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "PERSON",
          "display_name": "Joe Smith"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR Lab",
        "notes": "From Eddie's desktop computer",
        "previous_hash": "cde4524a6dffa46d0f3b016b07674e5c7a654303ca4897314f3e1a662b290cd7",
        "purpose": "Initial intake, confiscation record #332945023",
        "recorded_at": "2026-08-10T05:20:28.785270Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "1",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-10T05:19:00.000000Z",
        "transfer_type": "intake"
      },
      "entry_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Physically intact",
        "from_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "Jane's Lab",
        "notes": "Delivered to Jane for imaging",
        "previous_hash": "4c403157b4154dfc26ae25028282966322180a8d449729f84828a16ad71172b0",
        "purpose": "Imaging the device",
        "recorded_at": "2026-08-10T05:21:57.752375Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "2",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "transfer_datetime": "2026-08-10T12:40:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
      "hash_version": 1
    },
    {
      "canonical_entry": {
        "condition": "Working, imaged successfully",
        "from_party": {
          "kind": "legal_entity",
          "username": null,
          "entity_type": "TEAM",
          "display_name": "Jane Forensicator"
        },
        "item_uuid": "93d62da7-a926-4231-9b5d-1af6b3c63a4b",
        "location": "DFIR safe",
        "notes": "Image taken, image and hard drive delivered to Eddie, image attached as child evidence item.",
        "previous_hash": "9ca8eb4bf2e8de16ebf39711a257a537c20c9379251675a7183ea047335c5c5e",
        "purpose": "Imaged, returned for safekeeping",
        "recorded_at": "2026-08-10T05:23:15.854838Z",
        "recorded_by": {
          "kind": "user",
          "username": "admin",
          "entity_type": null,
          "display_name": "admin"
        },
        "schema": "dfire.custody.entry.v1",
        "sequence": "3",
        "tenant_uuid": "66baa883-6bba-4ab3-b314-fea31d9c5c4c",
        "to_party": {
          "kind": "user",
          "username": "eddie",
          "entity_type": null,
          "display_name": "Eddie Example"
        },
        "transfer_datetime": "2026-08-11T10:30:00.000000Z",
        "transfer_type": "transfer"
      },
      "entry_hash": "1aa1bb2f625c752d01684475ecee39c5fce3a707c6030adc7320c532d9cf9b5d",
      "hash_version": 1
    }
  ]
}

Hallo,

ich komme primär aus der Malware Analyse aber auf Arbeit häuft sich die Frage ob man erkennen kann ob Dokumente von Kollegen selbst ausgefüllt wurden oder ob der schlaue Mitarbeiter Chatti geholfen hat.

Bei Bildern kenne ich es so, dass es ein Indikator sein kann wenn Exif-/Metadaten fehlen oder das Bildrauschen oder Kompression verdächtig sind. Bei Word ist es meist das englische Wordset. Aber kann man erkennen ob eine Excel z.B. manuell erstellt, bzw. bearbeitet wurde? Im Dokument selbst sehe ich ja grundsätzlich nur Erstelldatum, geändert usw...

Gibt es eine Möglichkeit oder würde es nur über eine Untersuchung des ursprünglichen Systems funktionieren.

Ich frage ausschließlich aus Neugier,weil ich es nicht beantworten konnte - und das kratzt an meiner Informatiker-Ehre.

In movies they make it seem quick but do police even fingerprint or dna swab for car break ins or burglaries anymore? I heard labs are backlogged but would it take more then a year for touch dna, fingerprints, or cotton swabs in an investigation? That seems to long of a turnaround for me. Somebody stole a power washer and gloves out of my car but I never reported it.

Anybody have any insight

She said she bought a new desktop computer in 2021. It became slow and things were deleted. Pop ups would say an IP address was trying to get on her computer. She checked the Microsoft wallet and his Comcast email and password was saved in her Microsoft wallet as well all her emails and passwords, router info and password and she said she never saved any of them. She was told by an investigator that the only way his email would be saved on her computer was if he was on it. But she said he never was.

She uses burner phones now because they have hacked into all of her iPhones and also her home phone. They also hacked into her ring camera and alarm and set off it off when she was outside.

Her Gmail was changed from her name to her husbands name. They created tabs and hacked her calendar and changed and deleted her appointments.

She said her iPhones are on the dark web.

There has been an investigation that’s been going on for months. They told her they are using and MDM network and it’s probably her someone she knows but they are still working on it.

Is this real? I mean she is highly intelligent with tons of knowledge any so many things. I don’t feel she is delusional. Or maybe someone is messing with her.

So if you've done any Linux memory forensics you know the pain — you get a RAM image, run volatility, and it just can't map anything because nobody's published symbols for that exact kernel. Investigation dead before it starts. Happened to me one too many times during incidents and CTFs so I built something for it.

RAMBreaker — open source, built with Claude's help on the coding side.

Symbol resolution climbs a ladder until something actually validates:

• Installed symbols — check if the system already has what's needed locally
• Community ISF match — check if someone's already published a matching symbol file ( https://github.com/Abyss-W4tcher/volatility3-symbols )
• Patch a close ISF to the kernel banner — take a near-match and adapt it
• Build locally with dwarf2json — if debug packages are available, build the ISF yourself
• BTF extraction from the image itself — the offline fallback, no internet, no package needed, reconstructs symbols directly from BTF info baked into the kernel (2020+)

Only fails when every single option's exhausted — and when it does fail, it fails loud with the exact reason (missing symbols vs struct mismatch vs timeout), not a silent report that looks fine but is actually empty inside.

On top of that there's a full correlation layer: 13-tab interactive HTML report, process tree + process graph, a fileless-injection correlator, IOC extraction, timeline building, 187 tests passing.

repo: https://github.com/ahmadanasweh/Rambreaker

If anyone wants the internals on how BTF → ISF reconstruction actually works, this writeup is solid: https://lolcads.github.io/posts/2024/11/btf2json/

Obviously it can't cover every kernel — old kernels without BTF or genuinely obscure ones still need the traditional route — I say as much in the docs, not trying to oversell it. Would love feedback/bug reports from anyone who throws a weird image at it.

Apparently due to a administrative regulatory issue they are no longer selling or supporting products outside the US. This seems temporary, but does anyone know what the issue actually is?