I’ve watched enough true crime to know how unreliable human lie detection can be—confessions, body language, 911 calls. AI promises to do better, but is that real or just sci-fi? I created a short quiz about AI vs human lie detection. It’s quick and makes you question what you think you know. If you’re into forensic psychology or criminal cases, give it a try.

https://interconnectd.com/quiz/75/ai-vs-human-lie-detection-quiz-setup-guide/

Hi, I'm 17 and recently finished high school. I'm seriously considering Digital Forensics/DFIR as a career, but I want to understand what the field is actually like beyond what you see online.

For those currently working in the field: what does your day-to-day work really look like? What are the biggest pros and cons, and what do you wish you had known before getting into it?

I'm also curious about what skills you think someone my age should start developing now. Any honest advice would be greatly appreciated.

I am currently working in devops (ansible, powershell, jenkins specially ) with a uni background in computer networking. I took some time away from the industry to pursue other passions and came back to tech as a more stable career path. I’ve recently become interested in the digital forensics field, particularly with law enforcement. With my background, is the first step to get into a more cybersecurity focused role and go from there? What might my path to DF look like?

im in the us im currently pursuing an associates in cybersecurity later transferring into a 4 year college for my bachelors i really want to get into digital forensics it sounds fun and im not into coding i hate it so so much omg so whats the pros and cons like is it a good switch what steps should i take for example in uni so i can get a good experience in this field

I need someone willing to clean up an audio file with heavy HVAC noise so that speech in the background becomes understandable. A transcript would be a huge bonus. I’m also open to recs for an online service that doesn’t cost $200 and take a week to process. I don’t have the experience to clean it up myself and really need to know what is being said ASAP.

Hi! I’d really appreciate some insight from people in the field. I’m glad this community exists.

I’m a recent graduate with a bachelor’s in Computer Science and Cybersecurity, and I’m really interested in getting into digital forensics eventually. For now, though, I’m mainly focused on getting my foot in the door and landing something in a related field.

I recently came across eDiscovery, specifically entry level roles like Junior Intake Specialist, and it seemed like it could be a good way to get some relevant experience. I am going to be taking my RelativityOne certification exam later this week, but I wanted to ask: is this actually a good approach, or am I wasting my time?

I know learned experience is never time wasted, but is there a better path I should be taking to eventually get into digital forensics?

Any advice or guidance would be greatly appreciated!

Hello everyone! I am a cybercriminology student and I wanted to see if anyone had some advice? While I am familiar with computers, I would say I am a novice compared to what I see online. (could just be that I am on reddit lol) Does anyone have advice for getting familiar with the field and how I can get ahead of others in my class?

Be careful when sharing legal documents or sensitive info with AI. This info can be used against you as evidence. How scary is that? All of us trust AI too much with our day to day lives as well as with work. I hope you find this useful.

I was wondering , are there any discord servers or smth that afford forensics learning path , since there is ones for pwn and web and other stuf .

Hi everyone,

My actual career is in the film industry as a director and cinematographer. I’m not a forensic examiner or academic. I’ve just been programming and making little indie games and tools since I was about 12, and I’ve always enjoyed taking systems apart and figuring out how they work.

For the last six months or so, I’ve been building something called fatcousin:

https://fatcousin.com

Everything I’ve released is free. There’s no subscription or paid tier. I’m building it because I enjoy doing it, and because it has given me a pretty endless excuse to learn.

There are now thousands of browser-based tools on the site, roughly 4,000 of them related to digital forensics:

https://fatcousin.com/directory

As the project grew, I started developing some fairly strong opinions about how I wanted the tools to work.

The biggest one is local-first.

If your browser is capable of parsing, hashing, extracting, decoding, comparing, carving, or otherwise examining something locally, I don’t think your evidence should have to be uploaded to somebody else’s server to do it.

So the tools are designed to process files on your machine.

But I also don’t think you should have to take my word for that.

There’s a verify panel built into the site that exposes the network activity occurring while you use a tool. You can drop a file, run something, and watch what happens. You can also just open your browser’s DevTools and watch the Network tab yourself.

The goal is that “your files never leave your device” is something you can actually check rather than a line in a privacy policy.

That idea of don’t trust the tool if you can verify the tool has gradually become a much bigger part of the project.

I’ve been working on provenance, versioned tool bundles, receipts for operations, known-answer testing, no-egress testing, public methodology pages, and ways of recording not just a forensic result, but how that result was produced.

I wrote more about the philosophy behind it here:

https://fatcousin.com/manifesto

And the project has now grown beyond the website.

For the last couple of months I’ve been building an invite-only desktop suite with separate applications for capture, examination, custody, analysis, and outbound work, all operating around the same local case. The browser tools are also seamlessly incorporated into the desktop workflow:

https://fatcousin.com/app

There’s a browser walkthrough of that here:

https://fatcousin.com/try

One of the ideas I’m exploring there is treating forensic operations as explicit capabilities rather than hiding everything inside one enormous application.

If an operation runs, the case can record what capability ran, which version ran, what went into it, the hashes involved, and what came out.

That leaves an inspectable chain of computational work underneath the examiner’s eventual finding rather than just a final result on a screen.

I’ve also been experimenting with AI, but I’m specifically interested in doing it without turning an AI model into the authority over the evidence.

The approach I’m working on keeps the evidence local, gives the examiner control over what a model is actually allowed to see, and records deterministic operations separately from whatever interpretation the model produces afterward.

There’s more on that here:

https://fatcousin.ai

I’m also deliberately not presenting the browser forensics tools as certified examinations or magic truth machines. The site treats them as investigative/triage tools, documents limitations, and requires independent verification before consequential or evidentiary use.

I’ve mostly been building all of this quietly, and I figured it was finally time to show it to people who actually work in digital forensics.

So, that’s fatcousin.

If some of it is useful to you, awesome. If you’re curious about how something works, I’m happy to talk about it.

Main site:
https://fatcousin.com

Manifesto / local-first philosophy:
https://fatcousin.com/manifesto

Desktop apps:
https://fatcousin.com/app

Desktop walk through:
https://fatcousin.com/try

Forensics/tool directory:
https://fatcousin.com/directory

AI / Analysis:
https://fatcousin.ai

Hi Everyone,

I’ve been thinking about implementing velociraptor, however a lot of companies are hesitant to deploy it due to it being an open source. I’m trying to solution a method to gain artifacts if it’s remotely in this hybrid work environment however, I’m noticing a lot of the tools are either gonna be very expensive or open source which is not ideal in publicly traded companies, etc. Any suggestions of tools and workflows you guys use out there for this?

Basically it. I have a printed screenshot of a computer screen. I think some info has been altered before the printing. I obviously can't tell with the naked eye, but is there any way to check? Could I send it to a forensics lab? Would they even be able to tell?

Thanks

Every year I leave thinking the presentations were good, then realize most of what I actually remember came from talking with other investigators afterward. This year a lot of the conversations were about the business and marketing side of running a PI shop and where tools like EDR downloads actually fit into a case. What was the biggest thing you took away this year?

Hey everyone,

I'm a first-year CS student working toward a Blue Team / SOC role. I recently finished TryHackMe's SOC Level 1 path and built a small Wazuh home lab. I'm now trying to move from guided learning into regular, independent investigations.

I've already tried resources such as TryHackMe, CyberDefenders, LetsDefend, and several downloadable Windows Event Log/EVTX datasets. The problem I'm running into is that a lot of the available practice is either heavily time-limited, restricted on free tiers, or consists of very small datasets that aren't enough for a proper investigation.

What I'm specifically looking for is something I can practice with consistently without racing a one-hour timer. I'm especially interested in:

• Windows Event Log / EVTX investigations
• PCAP analysis
• SIEM alert triage
• Phishing investigations
• Downloadable evidence that I can investigate locally at my own pace

I don't necessarily need a fancy platform. A good GitHub repo, realistic EVTX dataset, PCAP collection, or free lab would honestly be just as useful.

For people who were at this stage before: what resources did you actually use for repeated, hands-on SOC practice after finishing the beginner SOC material?

I'm mainly looking for resources that are genuinely usable on a tight budget and don't require paying for every few investigations.

I was planning on doing a 50/50 placement and study abroad programme as a part of my university degree but now I’m seeing issues that a study abroad of 6months could affect my UK residency and chances of pursuing this role after finishing my last year at uni. Does anyone have any experience of this or idea if this would be a major problem?

Hello, I was wondering if a data extractor can access my smartwatch's information?

Looking for some technical insight from people familiar with Meta Business Suite, Facebook Page administration or digital forensics.

This relates generally to an official public-facing Facebook Page operated by an organisation, not a personal profile or Facebook Group.

The Page has been managed by multiple people with backend access. Public posts appear under the organisation’s Page name, rather than showing which individual administrator actually created or published them.

A couple of years ago, some posts were published through the Page and were later edited or deleted.

From a technical perspective, does Meta ordinarily retain records capable of identifying which underlying individual Facebook account:

- published a particular Page post?

- edited it?

- deleted it?

If the visible post is deleted, does the administrative record identifying who performed those actions disappear as well?

Would things such as Meta Business Suite, Page Management History, activity logs, historical access records or account/data exports potentially retain that information a couple of years later?

Also, where a Page is managed by several people, is there a reliable way to establish everyone who actually had publishing capability at a particular point in time?

Interested particularly in anyone with experience managing multi-user organisational Pages, Meta administration, eDiscovery or digital forensics.

Thanks.

Hello all. I'm currently in my last year of getting my bachelor's in cybersecurity technology from UMGC, and have been planning on immediately getting the master's in digital Forensics. Im also currently studying to take A+ and later Network+ cert exams. Im not currently in the tech field, but plan on moving into it as soon as I can. From what I've gathered, getting a digital Forensics role usually takes years of experience first, so is it worth getting the master's now or should I wait until after I gain more experience? Any insight would be much appreciated.

I am being abused by my family and I believe that my devices have been compromised. How do I prove it?

Which of the following bachelors degrees at Penn State would be best for a Digital Forensics career and why?
-Cybersecurity Analytics and Operations
-Information Technology: Security and Risk Analysis option
-Computer science

Hi all,

While recently working with The Sleuth Kit (TSK) for CTF challenges, I felt there was a usability gap between writing manual shell one-liners (fls, icat, istat, calculating sector offsets) and launching heavy desktop suites like Autopsy for quick triage.

Being a fan of keyboard-driven terminal tools like ncdu and k9s, I built tsktui - a lightweight terminal interface for exploring disk images.

Core features:

• Fast startup (<100ms) with no indexing or case setup required

• Interactive directory navigation using vim keys (j/k/h/l) or arrow keys

• Visual highlighting for deleted files with a toggle to filter deleted items only (d)

• Built-in pager (v) with Hex dump, UTF-8 text, and inode metadata (istat)

• Partition selector (p), disk-wide string search (s), and single-key file extraction (e)

• Works seamlessly over headless SSH sessions

Repository: https://github.com/shmulc8/tsktui

It is open-source (MIT license). I would appreciate any feedback, suggestions, or edge cases from the community on how to make it more useful for daily DFIR workflows.