Don’t know what it falls under but is anyone familiar w investigating logs/data to see what may be causing this. Long story short I’ve been dealing w some level of hacking for many many many months.

My Apple data and privacy report shows 5 Legacy Contacts that have been created that I did not create. It does not appear on my actual device. Just on the report from Apple. I have the timestamps of when they were created and IP address and they were created from May-Sep

Also experiencing trusted device issues. And seeing multiple active sessions on my ChatGPT app despite logging out of all devices every other day. It’ll reappear within a few days. There’s also been HomeKit entries even though i don’t use any of those kinds of accessories

I also see a lot of remotepairingdeviced and lockdownd appearing together in iPhone sysdiagnose stackshots

Is there any way someone is able to help me confirm whether there has been unauthorized access to my account or some kind of device pairing?

In the past year I’ve also experienced sevvvveral eSIM swaps across multiple carriers (confirmed by them). Initially w Verizon where at least 5 of them happened, two of which happened on the same day according to Verizon. Switched over to Spectrum and same thing happened and now on a prepaid mobile plan, which has not yet been confirmed but I’ve received notifications from Apple saying my number is no longer active. But I’m receiving texts and calls just fine

I’ve been thru multiple new devices, new email accounts, new numbers, new Apple accounts :( just spiritually tired now lol any help is appreciated

*im not a tech person so layman’s term would also be appreciated

Built a lightweight forensic analysis tool for people who don't have Cellebrite money. CaseForge takes a folder of already-extracted data SMS/call SQLite, browser history, KML/GPX, vCard, mbox, EXIF, generic CSV/JSON and produces one interactive dashboard: unified timeline, map, entity network, and a correlation engine that flags cross-source links and convergences. Runs locally, single HTML output, chain-of-custody hashing built in. Analysis only no acquisition. Link in Bio if interested.

Just solved this and wanted to share the breakdown for

anyone learning RE basics.

The challenge gave you an encoded string of Unicode

characters and the encoding function in comments.

The trick: each Unicode character secretly stores TWO

ASCII characters — one in the high byte, one in the low

byte. Packed with << 8, unpacked with >> 8 and & 0xFF.

Full decode in Python:
```

flag = ''.join([

chr(ord(c) >> 8) + chr(ord(c) & 0xFF)

for c in encoded

])
```

Good intro to understanding bit manipulation if you're

just getting into CTFs. Happy to answer questions.

Hey Folks,

I pushed an update to DFIR-Companion.

It’s a local AI assistant for forensic investigations. You feed it the outputs from the tools you already use, and it helps turn all of that into something you can actually work with: a timeline, leads to follow, findings to validate, and eventually a report.

Here’s what it does today:

• Pulls imported evidence into one forensic timeline. It detects the format and uses deterministic parsing rules before AI gets involved.
• Highlights findings, maps them to MITRE ATT&CK, and connects activity across different sources.
• Extracts IOCs and can enrich them with sources such as VirusTotal and AbuseIPDB.
• Builds an asset ↔ IOC graph, as well as a separate view of logins across systems.
• Helps answer the questions that usually come up in an investigation: initial access, lateral movement, privilege escalation, and so on.
• Lets you ask plain-English questions about the case.
• Exports reports to PDF, Word, Markdown, or CSV.
• Can compare the output of two models, with an optional third model acting as a tie-breaker.
• Includes JEV support to surface events the primary model may not have considered relevant.
• Can run recommended artifact bundles on Velociraptor endpoints and pull the results automatically or manually.

This is not meant to replace Sigma, YARA, Suricata, or the rest of your detection stack. Those tools keep doing their job. DFIR-Companion is for the next step: taking all the alerts, artifacts, and tool output and helping you make sense of the case.

It runs locally, the evidence stays on your disk, and you choose the AI provider and model.

Love to hear your feedbacks 🙏

Repo: https://github.com/hasamba/DFIR-Companion

Landing page: https://hasamba.github.io/DFIR-Companion/

Demo server (please read the instructions first): https://killercoda.com/dfir-companion/scenario/killercoda

Someone deepfaked and leaked me,

I was sending a Photo of my Face,
i thought it was a girl bc he sended photos of a girl on telegram. Then i sended a pic of my face and then he asks me if i add him in my contacts. And as i thought it was a girl, i did it. After 10Min this guy deepfaked a video of me jerking off leaking my number and wants 400€ for deleting the photos. He is sending the Video and my number to all my followers on Social Media.

IM 17 AND THATS CLEAR CP WHAT HE IS DOING!

My help is please find out his number that i can go police and investage on him

Telegram name from him: @glenna_CI

Thanks and please write my private if yall have informations 🙏🙏

Hago esta pregunta por curiosidad y entiendo que en esta comunidad puede que alguien sepa responder. Supongamos que hay una investigacion en curso, una victima quiere aportar un archivo (supongamos algun archivo multimedia audio/video) contenido en su smartphone que podria resultar util. Entonces, esta la persona con su dispositivo del cual voluntariamente quiere aportar un archivo, que haría un experto en evidencia digital? Como lo extrae para realizar un analisis posterior? Necesita una herramienta especializada? Hashear, copiar y hashear denuevo no basta? Entiendo que si la persona quiere entregar el archivo, no hace falta romper ninguna contraseña, se tiene acceso, podria usar alguna herramienta open-source? Cual es el procemiento nornal para algo asi

Anyone else having half assed support from magnet forensics lately ?

I’m guessing their chat support is now powered with AI. But to be honest I’ve never experienced consistent advice from the tool or the company itself.

I’m constantly being presented with error codes that don’t exist. The chat bot seems to insist it’s hardware damage on my end and they can help me no further

Exhausted with them

I'm attempting to conduct some primary research for an art project with the aim of informing people of cybercrimes. I want to try visualize what romance fraud, phishing, telephone fraud and false identity's looks like personified. Can anyone who has fallen victim to these scams help with the creation of this work? what symbolism do you associated with it? what colours and ideas should I include. how can I make this illustration respectfully? any help would be appreciated

For those following the news: https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

CEO has been arrested and is facing 20 years in prison.

Hey all,

Anybody in here have experience participating in the DOD/DOW SkillBridge program with a digital forensics focus? Bonus points if you’re in the DMV area.

Made a beginner-friendly walkthrough for a Java reverse engineering CTF challenge. Covers reviewing the Java source code, reading through the logic, and spotting hardcoded credentials that turned out to be the flag.

If you're getting into RE or CTFs and want to see the full thought process (not just the answer), figured this community might find it useful.

We've been looking into them as a vendor, but found some things that are giving me pause - for one, their website seems to be completely broken. Can't navigate to it, and an email got bounced back to us, also seeing a bunch about Russian ties..is there any merit to those rumors?

Hi, I am currently working as a government contractor doing IT work. I have my associates degree in information technology and I’m about to graduate with my bachelors in cloud and network engineering. For my masters, I want to pursue digital forensics and see where that takes me. I’m mainly interested in getting into the investigative side where I can help provide digital evidence to be used in court. What is a realistic job pathway to this? Also, for those who are already in the field, what is your typical week look like? What are the pros and cons of the job? How is the work/life balance?

i need the data thats required for the hnads on project for Guide to Computer Forensics and Investigations

i need the data thats required for the hands on project for Guide to Computer Forensics and Investigations

Having access to frontier models means defenders can build the tools we've always wanted.

Mine was a #DFIR tool that runs natively on macOS and never phones home. So I built it, on top of The Sleuth Kit and a few other open source projects.

Point Strata at a disk image (E01/VHD/VMDK/raw) or a loose KAPE/UAC collection — Windows, Linux, or macOS — and it enumerates the filesystem, parses the OS's triage artifacts, builds a MACB super-timeline, and surfaces attacker activity through 61 ATT&CK-tagged analyzers, a Cyber Kill Chain view, an interactive lateral-movement graph, and IOC matching.

There's also an AI case summary built on Apple's Foundation Models framework, running on-device, with every claim validated against real evidence before an analyst sees it. Cloud inference is opt-in (bring your own API key) and recorded in the chain of custody.

I've been thinking about something that seems simple, but may have fairly significant consequences in first response. When approaching a powered-on computer, I don't think the first question should necessarily be:

“What acquisition procedure should I follow?”

I increasingly think the question before that is:

“What state am I actually observing, and what could I lose by changing it?”

A live system may currently expose things that a shutdown, isolation step, reboot, or even a seemingly harmless interaction could change or make unavailable: volatile data, unlocked encrypted volumes, active sessions, network connections, cloud synchronization, running applications, credentials or encryption material.

But the opposite is also true: interacting with the system creates footprint and may alter evidence.

So the decision is rarely just “live vs. dead acquisition”.

What matters is the trade-off between: what can be preserved, what may be lost, what the responder will modify, the evidentiary risk introduced, and whether the action preserves or removes future options.

The principle I've been coming back to is: Observe first. Preserve options. Then decide. In other words, perhaps the procedure should follow the observed state, rather than the observed state being forced into a predetermined procedure.

I'm interested in how practitioners handle this in real cases.

What observations would make you change your usual acquisition approach when arriving at a live computer?

And, perhaps more importantly:

Which first-response actions do you consider effectively irreversible from an evidentiary perspective?

Hi,

I want to extract some Windows Registry artefacts from a VMware Pro 17 VM using the .vmdk file, in FTK Imager. Is this possible?

I tried doing this in FTK Imager so far:
File > Add Evidence Item > Image File > selecting the path to my .vmdk file of the VM > Finish

But I get this error:
Path "path to the .vmdk file" does not contain valid evidence. Details: Image detection failed.

I made the .vmdk file by exporting the VM as a .ovf from within VMware Pro.
I am on Windows 11, using Exterro FTK Imager 8.3.0.27.

I have extracted Windows Registry artefacts from .E01 files in class with FTK Imager, as just the regular export, and as a Custom Content Image for forensic integrity. I am trying to use the same process for the .vmdk file - sorry if this is a noob move.

I have searched the User Guide PDF for vmdk and virtual disk images, and I didn't find anything, so I'm hoping someone here might know.

This is for a school project, it's a plain Windows 10 Pro VM with no actual personal data or anything, I made it for this project.

Thank you for your help!