We come back from a busy conference stretch and go hands-on with new digital forensics tools that speed up real workflows across vehicle, iOS, and Android investigations. We also tour major updates to LEAPPs and LAVA, show how Batch LEAPP changes multi-extraction processing, and end with a hard question about validation that every examiner needs to take seriously. 

Show Notes:

North Loop Consulting: Sedgwick and NCL Spectator https://northloopconsulting.com/

Crush Digital Forensic Analysis Workbench: https://github.com/kalink0/crush-forensics

LEAPPS: leapps.org

 AI is becoming more common in digital forensics, but the biggest danger is people trusting it too much. Heather Barnhart discusses a framework that helps examiners assess when AI is appropriate, where it can assist with tasks like triage, and where it should not be used, while keeping trained human experts responsible for decisions. 

Notes:

https://www.linkedin.com/posts/heather-barnhart-cellebrite_ai-dfir-digitalforensics-ugcPost-7463670252950847488-b7s-/

“The tool said” might be the fastest way to lose a jury. Recorded live at IACIS, we sit down with Stacy Eldridge and Becky Passmore of Parsing The Truth One Bite At A Time, two former FBI senior forensic examiners who build a true crime-ish podcast around one thing most shows ignore: the digital artifacts and the courtroom testimony that prove what happened.

https://parsingthetruth.com/

Tool output can look authoritative while still being dangerously easy to misread, and we’ve both seen how fast that goes sideways when a case hits court. Live from the MSAB Digital Summit 2026, we walk through a simple principle that saves careers: an artifact is a clue, not a conclusion. We talk about how “artifact worship” happens, how to build real corroboration, and why multiple records on the same phone are not automatically multiple lines of evidence.

We also get honest about forensic reporting and peer review. Assuming “legal will catch it” is a trap, because attorneys and supervisors may not be able to validate the technical meaning of a timestamp, a parser decision, or an attribution statement. We share practical ways to write clearer digital forensics reports, verify tool parsing, and test your assumptions so you’re not learning hard lessons under oath. If you work mobile device forensics, this section is for you.

From there we shift into training and deep technical skills that are quickly becoming baseline: Android RAM acquisition and analysis, what kinds of artifacts can show up in memory, and why RAM can hold evidence you may never find in a file system extraction. We also unpack protocol buffers (protobuf) and the uncertainty that comes with app data when the .proto schema is missing, plus why that matters when AI and automation start “helping” with interpretation. We wrap with an ALEAPP update, a reminder that a portable tool report isn’t analysis, and a quick look at how standards like Daubert and Frye raise the bar for methodology.

Notes:

Brett Shavers Blogs: 

It’s Not Artifact Worship When One Artifact Actually Changes the Case https://www.linkedin.com/pulse/its-artifact-worship-when-one-actually-changes-case-brett-shavers-nwi6c/

I Thought Legal Would Catch It. They didn’t. https://www.brettshavers.com/brett-s-blog/entry/i-thought-legal-would-catch-it-they-didnt

IACIS https://www.iacis.com/events/in-person/2026-orlando-training-conference/

A blue jay, a busted feeder, and a brand-new camera set the tone, but only briefly. 

We kick off the new year with updates from the Florida ICAC conference, including firsthand courtroom experience watching frame rate and frame count testimony in action. The episode centers on Frame Counts Galore, an open-source script for extracting and hashing every video frame, calculating true variable frame rates, and producing transparent, courtroom-ready logs and reports.

We cover upcoming DFIR conferences, introduce a lightweight AI Provenance Scanner for fast C2PA and metadata checks, and reflect on standout moments from the digital forensics year—especially the impact of open-source tools and honest conversations about the realities of the work. 

The episode closes with a 2026 wish list focused on stronger education, fair workloads, and customizable forensic reporting that analysts can actually defend in court.

Happy New Year to the DFIR community.

Notes:

Frame Counts Galore-

https://github.com/abrignoni/frame-counts-galore

Upcoming Conferences- 

https://www.iacis.com/                        

https://www.msab.com/digital-summit-2026/ 

https://magnetvirtualsummit.com/              

https://www.technosecurity.us/

https://ofta.cellebrite.com/event/cellebrite-c2c-user-summit-2026/

AI Provenance Scanner-  

https://github.com/abrignoni/AI_Provenance_Scanner

Brett Shavers Blogs-                                                    

https://www.brettshavers.com/

UFADE & ALEX-                                                              

https://github.com/prosch88

This episode digs into the habits that actually hold up: learning from CTF wins and post-event reviews, exploring scholarships and Reno trainings that build technical muscle, and walking through expert-witness prep that turns courtroom stress into structured, confident testimony.

We’ll unpack Brett Shavers’ reminder that truth alone doesn’t win cases—procedure, documentation, and bias-aware methods do. Clear writing matters too; vague language can undermine solid work.

On the tools side, RabbitHole v3 now recovers deleted SQLite records and rebuilds them into query-ready databases—speeding validation and reporting without losing traceability. We’ll also demo the new Android Logical Extractor: pull device info, logs, and scoped chat data with hashes and ready-to-file PDFs. It’s ideal when consent is limited or full file systems aren’t on the table, and integrates cleanly with downstream workflows.

Throughout, we emphasize one idea: tools are abstractions. If you can’t explain how a result was produced or reproduce it, you don’t own the finding. That’s especially true with AI. Generative models are nondeterministic—useful when documented, risky when their prompts or scope stay hidden. We’ll cover prompt disclosure, reproducibility, and how to write about “deleted” data with precision: previously existing, marked deleted, not referenced—describe state, not intent.

If you’re serious about improving testimony, validating results, and adopting new tools without losing forensic footing, join us. Then share your take on AI prompts and language precision—what will you change in your next report?

Notes: 

IACIS Scholarships
https://www.iacis.com/awards-and-scholarships/will-docken-scholarship/
https://www.iacis.com/awards-and-scholarships/womens-scholarship/

Training Opportunities!
IACIS Reno
https://www.iacis.com/events/in-person/reno-nv/


Free DFIR Test Images + Industry Tools to Analyze Them
https://www.dfir.training/downloads/test-images

New Blogs from Brett Shavers!
https://www.linkedin.com/pulse/theres-lot-more-trial-than-you-may-know-even-have-100-brett-shavers-br4sc/
https://www.linkedin.com/pulse/case-almost-made-me-quit-dfir-shouldve-news-brett-shavers-pie1c/
https://www.linkedin.com/pulse/i-when-digital-forensics-lost-its-soul-brett-shavers-otkec/
https://www.linkedin.com/pulse/end-dfir-again-dfir-training-ab5jc/
https://www.linkedin.com/pulse/how-wreck-your-report-affidavit-testimony-one-word-brett-shavers-qkyvc/
Free Webinar
https://www.suspectbehindthekeyboard.com/fighting-city-hall-dfir-lessons-from-a-pro-se-plaintiff

Rabbithole Update
https://www.linkedin.com/posts/rabbithole-dataviewer-sqllite-ugcPost-7384144022065274880-0d0D
https://www.cclsolutionsgroup.com/forensic-products/rabbithole

ALEX Release
https://github.com/prosch88/ALEX
https://github.com/RealityNet/android_triage

A baby camel, a high-speed chase, and a heartfelt tribute set the stage for a season opener that is equal parts human and hard-nosed.

We pause to honor Mark Baker, mentor, officer, and friend.

This episode spotlights a free Belkasoft AI course along with the much-anticipated release of Rabbit Hole v3, designed to tackle complex data structures.

From there, it is all about blogs, and there are plenty of them. Mattia explores extraction nuances, showing how AFU versus BFU states and encryption classes still determine what you can recover from iOS and Android. Hexordia provides important guidance on first responder missteps, emphasizing how early handling and precise thinking safeguard the integrity of a case.

We also showcase open-source and budget-friendly tools such as Autopsy and IPED, which expand analysis capacity without breaking the bank.

 A hands-on demo of Gallery Builder illustrates how to create courtroom-ready visuals, paired with a reminder that “vibe coding” with LLMs is no substitute for validated forensic standards.

Finally, we close with the latest LEAPP and LAVA updates, which continue to push practical workflows forward for the field.

Notes:
BelkaGPT: Effective Artificial Intelligence in DFIR
https://belkasoft.com/belkagpt-training

Training First Responders in Digital Evidence Handling: How To Protect Your Department from Case-Destroying Mistakes
https://www.hexordia.com/blog/training-first-responders-in-digital-evidence-handling

The Packd Byte
https://www.thepackdbyte.org/

Two New Blogs from Mattia 
http://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-android.html
https://blog.digital-forensics.it/2025/09/exploring-data-extraction-from-ios.html

SWGDE
https://www.swgde.org/documents/published-complete-listing/16-f-002-considerations-for-required-minimization-of-digital-evidence-seizure/

Gallery Builder
https://github.com/charpy4n6/GalleryBuilder

We celebrate our two-year podcast anniversary and discuss the importance of thorough case preparation for CSAM cases, courtroom experience, and extracting evidence from iOS devices.

• SANS Difference Maker Awards open for nominations through September 15th across multiple categories
• AI debate webinar with Magnet Forensics scheduled for September 17th
• Binary Hick's blogs reveal insights on iOS search party and Samsung's Rubin and Digital Wellbeing databases
• Discussion on properly preparing CSAM cases for trial with understanding of statutes and evidence requirements
• Brett Shaver's article highlights importance of attending trials to understand courtroom proceedings
• iOS File Provider Storage in BFU extractions can reveal user-created images with metadata
• Updates to LEAPPS tool including CashApp parser improvements and Snapchat returns parser
• New Lava viewer coming soon for the LEAPPS project

Notes:

SANS Difference Makers Awards-

https://docs.google.com/forms/d/e/1FAIpQLSeLNMZm3r4c9WSKdNW8XaPh6KRXoS3C1WI51UtnEANe2osCpQ/viewform

AI Unpacked #5: The great AI debate with Digital Forensics Now-

https://www.magnetforensics.com/resources/ai-unpacked-5-the-great-ai-debate-with-digital-forensics-now/

The Binary Hick New Blogs-

https://thebinaryhick.blog/2025/08/19/further-observations-more-on-ios-search-party/

https://thebinaryhick.blog/2025/08/06/not-strange-bedfellows-samsungs-rubin-digital-wellbeing/

Monolith Notes-

https://www.monolithforensics.com/free-tools

Brett Shavers- Courtroom Trials Are the Final Exam for Your Work. Why Haven’t You Attended One?-

linkedin.com/in/brettshavers/recent-activity/all/

We're back! After a short break we are back to discuss the growing crossover between real-world events and digital evidence in court cases, highlighting how device data can make or break timelines in high-stakes investigations.

This episode covers:

• Ian Whiffin’s latest forensic work, including iOS power log timestamps, Apple Health data reliability, iPhone battery temperature readings, and IR Doppler functionality – with examples of how these artifacts were used in a recent homicide trial to validate timelines and environmental conditions.
• Kevin Pagano’s App Store Package Search tool, which translates obscure bundle IDs into recognizable app information for easier analysis.
• Concerns over the growing reliance on AI in digital forensics, emphasizing the need for human expertise and proper validation in every step of the process.
• A demonstration of LUMYX, a mapping tool that converts extracted location data into customizable visual timelines for courtroom presentations.
• Updates on LAVA (LEAPPS Artifact Viewer App) and guidance on writing LAVA-compliant artifacts to improve reporting workflows.

Notes:

Ian's FOUR Newest Blogs
https://www.doubleblak.com/blogPost.php?k=powerlog
https://www.doubleblak.com/blogPost.php?k=healthaccuracy
https://www.doubleblak.com/blogPost.php?k=temperature
https://www.doubleblak.com/blogPost.php?k=doppler

Ian Whiffin Testimony
https://www.youtube.com/watch?v=kahgl-mIUFE

Kevin Pagano Stark4n6 app store package search
https://www.stark4n6.com/2025/07/introducing-asp-app-store-package-search.html
https://github.com/stark4n6

Elcomsoft Article- AI driven Password Recovery Myth or Reality?
https://blog.elcomsoft.com/2025/07/ai-driven-password-recovery-myth-or-reality/

Beyond the Badge AI's role in Modern Investigations
https://www.magnetforensics.com/blog/beyond-the-badge-ais-role-in-modern-investigations/

LUMYX
https://lumyx.com/

LEAPPs
leapps.org

How to make LAVA Compliant LEAPP Artifacts
https://www.linkedin.com/video/live/urn:li:ugcPost:7356497708628520962/

UFADE 
https://cp-df.com/en/blog/ufade_touch.html

We kick off this episode with highlights from the Techno Security Conference, our 80s-themed outfits, packed LEAPP labs, AI panel discussions, and great conversations with friends and colleagues across the field.

We discuss Brett Shavers’ recent series on DFIR entry-level work, and share our thoughts on the need for better forensic training and clearer distinctions between forensics, cybersecurity, and incident response.

We also talk about recent tool changes in the industry. Cellebrite’s acquisition of Corellium could make mobile app testing more accessible, and Magnet’s purchase of Dark Circuit Labs.

We cover Harper Shaw’s Vehicle Network App, a valuable source of vehicle-related data. Alongside that, we highlight a recent blog on cached screenshots in Windows 11. 

Be sure to check out the excellent “Parsing the Truth” podcast.

Heather walks through her Easter road trip to test Android's Timeline feature (formerly Google Location History). The location data was impressively accurate, but also showed how easily some points can mislead without the right context.

Catch us at IACIS Reno in January and check out the some of the resources we mentioned.

Notes:

Parsing the Truth: One Byte at a Time 
https://parsingthetruth.com/

Cached Screenshots on Windows 11
https://thinkdfir.com/2025/06/13/cached-screenshots-on-windows-11/

The Vehicle Network App from Harper Shaw
https://harpershaw.co.uk/the-vehicle-network-app-1

Beklkasoft CTF
https://belkasoft.com/belkactf7/

Brett Shavers 6 part series
https://www.linkedin.com/pulse/dfir-really-entry-level-brett-shavers-ewsvc/
https://www.dfir.training/new-to-dfir/dfir-career

Artifact of the Week/Android Location History
https://thebinaryhick.blog/2024/06/28/the-green-look-back-androids-on-device-location-history/

Apple devices are constantly recording user activity, yet few forensic examiners are making use of the vast amount of data these systems quietly generate. Apple's Unified Logs and Spotlight databases track nearly everything that happens on an iOS device, often without the user realizing it.

Would you believe an iPhone can generate around 1.5 million log entries in just 15 minutes of regular use? These records include highly specific actions—such as the exact moment Face ID is used to unlock a device, when the phone is flipped face-up, or whether a user interacted with Siri or used the device manually. Despite their detail and reliability, these sources are often overlooked in mobile investigations.

In this session, we’ll show how forensic practitioners can process and search these massive log sets using open-source tools. We’ll walk through examples of log entries that record actions like toggling airplane mode, launching specific apps like Facebook, or even detecting changes in device orientation. For investigators, this means direct, time-stamped evidence of how a device was used.

One of the most valuable aspects of this data is its ability to help distinguish between user actions and automatic background processes. Was an app opened by the user, or was it a system event? These logs provide that level of clarity. We’ll demonstrate how to isolate specific events from millions of entries and construct accurate timelines that reflect exactly what happened—and when.

As part of our ongoing work, we’re also focused on improving the accessibility and usability of these artifacts with incorporation into the LEAPPS. If you work with iOS devices, this is a session you won’t want to miss. 

Notes:

2026 IACIS in Reno NV-

https://www.iacis.com/training/reno-info/

Spotlight-

https://github.com/ydkhatri/mac_apt

Unified Logs-

https://www.ios-unifiedlogs.com/

https://github.com/abrignoni/iLEAPP

The Digital Forensics Now podcast brings together the core LEAPPs developer team for a candid, unscripted conversation about mobile forensics, legal challenges, and the future of their tools during the IACIS conference in Orlando.

• First time bringing together most of the LEAPPs development team in person
• Florida's new requirement for 10-day search warrant renewals creates significant challenges for long-running forensic processes
• Timestamp parameters in warrants can limit investigators' ability to discover relevant evidence
• Paladin now includes the LEAPPs integration, making powerful open-source forensic tools more accessible
• Real-world success stories of the LEAPPs helping solve cases when commercial tools failed
• Introduction of "The DFIR Investigative Mindset" book with technical editor Lee Harris
• Multiple specialized forensic training courses available at IACIS including incident response, drone, MAC and RAM forensics

Join us in two weeks for a more technical episode exploring new forensic artifacts and techniques.

The digital forensics world isn’t slowing down — and neither are we. In this episode, we celebrate Heather’s well-deserved recognition as Cellebrite’s Mentor of the Year 2025. Naturally, there were a few speech mishaps and, somehow, a bear raiding Heather’s bird feeder (yes, actual wildlife). But between the chaos, we get serious about the fast-changing landscape of digital evidence collection.

We dig into Amazon’s decision to remove the "do not send voice recordings" setting from Echo devices — meaning all voice requests now head straight to the cloud for AI training. It’s part of a growing industry trend, raising huge privacy red flags. We also unpack a study showing AI search engines misattribute sources at rates over 60%, and discuss how leaning too hard on generative AI risks dulling the critical thinking that digital forensics demands.

On the technical front, Christian Peter reveals that some forensic tools alter or delete unified logs during extraction — a serious concern for evidence integrity that can compromise investigations before they even begin. We also walk through a deep dive into Snapchat artifacts, showing how to connect media files to user actions and locations by following database breadcrumbs that automated tools tend to overlook.

Through it all, one theme stays clear: while technology keeps racing ahead, the responsibility for getting it right stays firmly with the examiner. As one guest bluntly put it, "We might be the last generation of cognitive thinkers."

Tune in for a sharp, insightful, and slightly unpredictable conversation at the intersection of bears, bytes, and the future of digital evidence.

Notes:

Mobile Forensics Are you nerd enough?

https://www.msab.com/events-webinars/webinar-are-you-nerd-enough/

New Podcasts!

https://osintcocktail.com/

https://www.youtube.com/@hexordia

Amazon "Do Not Send Voice Recordings" Privacy Feature

https://www.usatoday.com/story/tech/2025/03/17/amazon-echo-alexa-reporting-privacy/82503576007/https://www.thesun.co.uk/tech/33907850/amazon-alexa-echo-do-not-send-voice-recordings

AI search engines cite incorrect news sources at an alarming 60% rate, study says

https://arstechnica.com/ai/2025/03/ai-search-engines-give-incorrect-answers-at-an-alarming-60-rate-study-says/

The Slow Collapse of Critical Thinking in OSINT due to AI

https://www.dutchosintguy.com/post/the-slow-collapse-of-critical-thinking-in-osint-due-to-ai

NIST

https://www.nist.gov/news-events/news/2025/01/updated-guidelines-managing-misuse-risk-dual-use-foundation-models

Don't lose your logbook

https://www.linkedin.com/pulse/dont-lose-your-logbook-christian-peter-ebcje

Not All Encryption is created equal

https://www.s-rminform.com/latest-thinking/cracking-the-vault-exposing-the-weaknesses-of-encrypted-apps

The boundary between tool-dependent analysis and true forensic expertise grows increasingly blurred as AI enters the digital forensics landscape. Alexis Brignoni and Heather Charpentier reunite after a month-long hiatus to sound the alarm on a concerning trend: the integration of generative AI into forensic tools without adequate safeguards for verification and validation.

Drawing from Stacey Eldridge's firsthand experience, they reveal how AI outputs can be dangerously inconsistent, potentially creating false positives (or missing critical evidence) while providing no reduction in examination time if proper verification procedures are followed. This presents investigators with a troubling choice: trust AI results and save time but risk severe legal and professional consequences, or verify everything and negate the promised efficiency benefits. The hosts warn that as AI becomes ubiquitous in forensic tools, it dramatically expands the attack surface for challenging evidence in court—especially when there's no traceability of AI prompts, responses, or error rates.

Beyond the AI discussion, the episode delivers practical insights for investigators, including an in-depth look at the Android gallery trash functionality. When users delete photos, these files remain in a dedicated trash directory for 30 days with their original paths and deletion timestamps fully preserved in the local DB database—a forensic goldmine for cases where suspects attempt to eliminate evidence shortly before investigators arrive. Other highlights include recent updates to the Unfurl tool for URL analysis, Parse SMS for recovering edited and unsent iOS messages, and Josh Hickman's research on Apple CarPlay forensics.

Whether you're investigating distracted driving cases, analyzing group calls on iOS, or simply trying to navigate the increasingly complex digital evidence landscape, this episode offers both cautionary wisdom and practical techniques to enhance your forensic capabilities. Join the conversation as we explore what it truly means to be a digital forensic expert in an age of increasing automation.

Ready to strengthen your digital investigation skills? Subscribe now for more insights from the front lines of digital forensics.

Notes:

Magnet Virtual Summit Presentations
https://www.magnetforensics.com/magnet-virtual-summit-2025-replays/
https://www.stark4n6.com/2025/03/magnet-virtual-summit-2025-ctf-android.html

parse_smsdb
https://www.linkedin.com/posts/alberthui_ios-16-allows-for-imessagesmsmmsrcs-message-activity-7279586088988413952-xHWl
https://github.com/h4x0r/parse_sms.db/tree/main

Are you a DF/IR Expert Witness or Just a Useful Pawn?
https://www.linkedin.com/posts/dfir-training_a-pawn-moves-where-its-told-a-dfir-expert-activity-7292981112463572992-c3wd/

Unfurl
https://dfir.blog/unfurl-parses-obfuscated-ip-addresses/
https://github.com/obsidianforensics/unfurl

AI to Summarize Chat Logs and Audio from Seized Mobile Phones
https://www.404media.co/cellebrite-is-using-ai-to-summarize-chat-logs-and-audio-from-seized-mobile-phones/

Ridin' With Apple CarPlay 2
https://thebinaryhick.blog/2025/02/19/ridin-with-apple-carplay-2/

Hello Who is on the Line?
https://metadataperspective.com/2025/02/05/hello-who-is-on-the-line/

Get ready for a hands-on look at digital forensics and the challenges professionals tackle every day. We share a story about forensic guessing that highlights the importance of testing assumptions and following the evidence to avoid errors. The discussion emphasizes how staying grounded in facts can prevent investigations from going off track.

We also highlight advancements in forensic tools and training. Learn about tools like Belkasoft, the UFADE tool for iOS device extraction, and SQBite for SQLite database analysis. These tools are improving efficiency and accessibility in the field.

 But it’s not all about the tech. We address the important topic of mental health in digital forensics. We discuss the pressures of the job, strategies for managing stress, and the importance of supporting one another. Personal experiences and practical tips highlight the need to prioritize mental well-being in this demanding field.

This episode provides valuable information on tools, investigative approaches, and mental health strategies for forensic professionals.

 

Notes:

Belkasoft Windows Forensics Course
https://belkasoft.com/windows-forensics-training

Updates to UFADE
https://github.com/prosch88/UFADE/releases

The Duck Hunter's Blog
https://digital4n6withdamien.blogspot.com/2025/01/the-duck-hunters-guide-blog-1.html
https://digital4n6withdamien.blogspot.com/2025/01/the-duck-hunters-guide-blog-2.html
https://digital4n6withdamien.blogspot.com/2025/01/the-duck-hunters-guide-blog-3.html

SQBite
https://digital4n6withdamien.blogspot.com/2025/01/introducing-sqbite-alpha-python-tool.html
https://github.com/SpyderForensics/SQLite_Forensics/tree/main/SQBite

Mental Health in DFIR
https://thebinaryhick.blog/2019/06/21/mental-health-in-dfir-its-kind-of-a-big-deal/
https://www.forensicfocus.com/podcast/the-impact-of-traumatic-material-on-dfir-well-being/
https://www.forensicfocus.com/news/dfir-and-mental-health-are-we-doing-enough-to-protect-investigators/
https://www.sciencedirect.com/science/article/pii/S2666281721000251
https://belkasoft.com/preventing-burnout-in-digital-forensics
https://www.magnetforensics.com/resources/taking-care-of-mental-health-during-digital-forensics-investigations/
https://www.harmlessthepodcast.com/
https://www.shiftwellness.org/about-us
https://www.nyleap.org/

What's New with the LEAPPS
https://github.com/abrignoni

Kick off your new year with some forensic fun as we recount our holiday escapades and dive into the latest in digital forensics! Ever wondered how RAM dumps from Android devices can reveal crucial data? We spotlight MSAB's innovative RAMalyzer tool and their new blog series covering RAM from mobile devices. 

Discover how the digital forensics community is collaborating to propel the field forward, as we share insights from the DF Pulse 2024 Digital Forensic Practitioner Survey and the delicate dance between competition and cooperation. Standardization is the name of the game, and we're exploring how the field of digital forensics can benefit from it. 

Updates to Magnet Axiom's date range capabilities showcase the ceaseless evolution of digital forensics tools. Journey with us as we tackle the intricacies of Bluetooth tracker detection, all while considering the dual nature of technology and the significance of using it responsibly.

From exploring Richard Davis's work with 13 Cubed to discussing Yogesh Khatri's contribution to analyzing the USN Journal, we shine a light on the vital role of principles in our field. 

With warm wishes for the new year, we invite you to stay tuned for more episodes brimming with insights and camaraderie.

Notes:
MSAB RAMalyzer series!
https://msab.com/resources/blog/


Paraben Forensic Innovation Conference
https://link.reachpenguin.com/widget/form/99kVMTgaA0mbpZvYLTjG

Tip Tuesday: Troubleshooting in PA
https://www.youtube.com/watch?v=eSNovfdwucw&list=PLwmKlEiYNUYte-pnlbw45YKpPB7K8xCgC&index=1

DFPulse: The 2024 digital forensic practitioner survey
https://www.sciencedirect.com/science/article/pii/S2666281724001719

Magnet Axiom Cyber 8.7: Acquire iCloud backups from ADP-enabled accounts, and more!
https://www.magnetforensics.com/blog/magnet-axiom-cyber-8-7-icloud-adp-and-more/

Android Will Let You Find Unknown Bluetooth Trackers Instead of Just Warning You About Them
https://www.engadget.com/mobile/smartphones/android-will-let-you-find-unknown-bluetooth-trackers-instead-of-just-warning-you-about-them-204707655.html

Be Kind, Rewind... The USN Journal
https://youtu.be/GDc8TbWiQio?feature=shared

Apple Photos phones home on iOS 18 and macOS 15
https://lapcatsoftware.com/articles/2024/12/3.html

SWGDE Considerations for Required Minimization of Digital Evidence Seizure
swgde.org/16-f-002/

Join us for a holiday-themed episode of Digital Forensics Now, where we blend expert insights with personal stories from the field of digital forensics.

This episode delves into cutting-edge tools and techniques for digital forensics. Explore insights from Arsenal on advanced methods for analyzing swap space and memory files. We also share experiences with the Samsung Secure Health Data Parser, highlighting the challenges of decrypting health databases and the critical role of UFED in overcoming them. Don’t miss an in-depth look at the remarkable features of ArtEX, showcasing its value to examiners. Additionally, we introduce the LEAPPS Artifact Viewer App (LAVA), a groundbreaking tool unveiled at the Cyber Social Hub conference. 

We discuss the vital role of forensic experts in legal proceedings, from the importance of meticulous validation to the risks of mishandling evidence. Real-world cases and a controversial court rulings that highlight why expert testimony remains essential in interpreting digital artifacts.

We close with gratitude to our listeners and warm holiday wishes. Stay tuned on social media for updates on our next live session after the holidays.

Notes:
Working with 010 Hex-Editor 
https://www.youtube.com/playlist?list=PLCS2zI95IiNwheFCTaUEytA1GT0mNOOdn 

Arsenal Releases a New Tool! 
https://arsenalrecon.com/additional-products 

Samsung Secure Health Data Parser - A Forensic Tool for Parsing & Analyzing Samsung Secure Health Databases https://github.com/breakpointforensics/Samsung-Secure-Health-Data-Parser-/tree/main 

ArtEx Artifact Examiner <br>https://www.doubleblak.com/app.php?id=ArtEx2 

Why the Manual Preview/Screenshots May Not Hold Up in Court https://www.forbes.com/sites/larsdaniel/2024/11/13/think-that-screenshot-is-proof-heres-why-it-might-not-hold-up-in-court/  https://www.forbes.com/sites/larsdaniel/2024/12/06/smartphone-forensics-and-fake-texts-how-are-courts-responding/ 

What's New with the LEAPPS!? 
Google Keep Notes <br>https://charpy4n6.blogspot.com/2024/12/google-keep-notes.html 
Signup for Updates! leapps.org

 

The latest episode of Digital Forensics Now kicks off with lighthearted banter about Heather's newfound fame in commercials, bringing a fun and relatable start to a tech-heavy discussion. Following the laughs, the conversation shifts to an invigorating recap of Alexis' recent experience at SANS DFIRCON, featuring interactions with digital forensics luminaries like Brian Maloney and Ian Whiffin. Ian's ArtEx tool, which cleverly maps locations for forensic investigations, also takes center stage as a highlight of the conference. The episode weaves in personal reflections, including a scenic family train ride from Orlando to Miami and the implementation of a Python artifact exercise during a teaching session.

The journey continues with a vibrant detour to the Tanganyika Wildlife Park in Kansas, where the usual birthday horseback riding tradition was replaced with unforgettable encounters like swimming with penguins, feeding giraffes, and snapping selfies with lemurs. These charming moments with nature set a refreshing tone before diving back into the tech world.

In the realm of digital forensics, the episode explores reverse engineering iOS 18, discusses the brief availability of BitLocker support in FTK Imager, and examines the evolving landscape of BFU (Before First Unlock) data extraction in law enforcement. The hosts delve deep into the complexities of digital forensics tools, translating technical data structures into accessible insights while emphasizing the importance of a strong digital evidence strategy. Topics include advancements in the LEAPP Parsers, the innovative Lava Viewer, and the latest developments in Blue Sky data structures, offering a comprehensive look at the tools shaping the field.

The episode wraps up with an open invitation for listeners to connect on social platforms, share their thoughts, and showcase innovative projects within the community, fostering a collaborative and forward-thinking space for digital forensics enthusiasts.

Notes
iOS Devices Rebooting Continuedhttps://naehrdine.blogspot.com/2024/11/reverse-engineering-ios-18-inactivity.html

Samsung Secure Health Data Parser https://breakpointforensics.com/2024/11/06/samsung-secure-health-data-parser-a-forensic-tool-for-parsing-analyzing-samsung-secure-health-databases/
https://github.com/breakpointforensics/Samsung-Secure-Health-Data-Parser-/tree/main

Mobile Forensics Data Structures: Extracting and Analyzing Data with Free Toolshttps://www.hexordia.com/blog/mobile-forensics-data-structures

GAMEPLANS: A template for robust digital evidence strategy developmenthttps://onlinelibrary.wiley.com/doi/10.1111/1556-4029.15655Digital Evidence 

Enhancing public safety using digital investigative technologieshttps://majorcitieschiefs.com/wp-content/uploads/2024/10/MCCA-Digital-Evidence-White-Paper-_-Oct-2024.pdf

Importance of BFU Partial Filesystem Extractions!https://www.linkedin.com/posts/1carl-lawrence_dfir-polcing-digitalforensics-activity-7264179600631468034-FHGh

Sumuri Gives Back 2024
https://sumuri.com/sumuri-gives-back-2024/

Join us on the Digital Forensics Now podcast as we explore the details of the iOS 18 inactivity reboot issue with mobile forensics expert Christopher Vance from Magnet Forensics. Chris traces the origins of this challenge back to iOS 17 and explains how unified logs play a key role in diagnosing these system memory resets. This episode is packed with valuable insights for anyone interested in the inner workings of iOS devices and the unique considerations they present in digital forensics.

We also discuss device security and data preservation, focusing on iOS devices. Examining the balance between law enforcement’s need for data access and Apple’s privacy measures, we highlight the importance of extracting the data from devices quickly to prevent data loss. Our conversation covers the legal complexities, jurisdictional nuances, and the demand for data preservation tools to address these challenges effectively.

We explore recent developments in mobile technology, specifically Android 15's "Private Space" feature and how it will effect the digital forensic community workflow. 

With insights from industry experts, this episode is full of essential updates tailored for digital forensics professionals looking to stay current.

Notes:
iOS Devices Rebooting
https://www.magnetforensics.com/blog/understanding-the-security-impacts-of-ios-18s-inactivity-reboot/

5 iOS forensics evidence sources to capture before they expire
https://www.magnetforensics.com/blog/ios-forensics-evidence-sources-to-capture-before-they-expire

Mac and iOS Forensic Analysis and Incident Response Poster
https://www.sans.org/posters/macos-ios-forensic-analysis/

Could AI in forensic analysis be more of a liability than an asset? Join us as we explore this pressing concern. 

We kick off this episode with an important update for those dealing with Android extractions. Recent changes to the Android OS and Google Play Store might be causing the Keystore (secrets.json) file to either miss data or not be extracted at all. This brings attention to the vital role decryption keys play in accessing data from mobile devices.

Next, we dive into advancements in forensic tools like MSAB’s new RAM analyzer for XRY Pro users. 

For iOS investigators, if you’re working with Cache.sqlite data, you’ll want to check out iCatch, a tool designed to map the data efficiently and streamline your workflow.

Shifting to the role of AI, we examine a recent legal case that highlights the dangers of relying on AI-generated results without proper verification. Accuracy and repeatability are key, and our discussion focuses on the ethical implications of using AI in forensic investigations. We emphasize the importance of thoroughly validating AI tools to maintain trust in the legal process.

Notes: 

Updated Telegram Policy
https://www.linkedin.com/posts/luca-cadonici-41299b4b_policy-telegram-cybersecurity-activity-7244258209979334656-AxPlhttps://telegram.org/privacy#8-3-law-enforcement-authorities

MSAB RAMalyzer
https://www.youtube.com/watch?v=1SEgSYSF03A

Expert witness used Copilot to make up fake damages, irking judge
https://arstechnica.com/tech-policy/2024/10/judge-confronts-expert-witness-who-used-copilot-to-fake-expertise/https://law.justia.com/cases/new-york/other-courts/2024/2024-ny-slip-op-24258.html

iCATCH
https://github.com/AXYS-Cyber/iCATCH

Join us as we discuss the latest blogs and training opportunities available to keep you at the forefront of digital forensics.

We’ll then dive into the release of iOS 18 and its impact on digital forensic investigations. Beyond tools and gadgets, we'll explore the shift towards cloud-based evidence storage, weighing its benefits and security challenges against traditional air-gapped networks.

Whether you're a seasoned professional or just beginning your journey, this episode offers a mix of education, entertainment, and a sense of community, all with a dash of geek culture fun.

Notes:

-Triple Trouble. iOS 16, Android 14, and iOS 17 Images Now Available!
https://thebinaryhick.blog/2024/09/14/triple-trouble-ios-16-android-14-and-ios-17-images-now-available/

-A First Look at iOS 18 Forensics
https://blog.digital-forensics.it/2024/09/a-first-look-at-ios-18.htmlhttps://www.magnetforensics.com/blog/a-look-into-ios-18s-changes/

-New iOS Feature - Brian Krebs Linkedin Post
https://support.apple.com/guide/iphone/request-give-remote-control-a-facetime-call-iph5d70f34a3/ios

-macOS 15 (Sequoia): What Forensic Examiners Need to Know
https://www.linkedin.com/pulse/macos-15-sequoia-what-forensic-examiners-need-know-sumuriforensics-ohbrc/

-25th Anniversary of Paraben
https://l.paraben.com/25-year-anniversary-3005

-Oxygen 2024 International User Summit
https://oxygenforensics.com/en/user-summit-2024/

-When is an app not an app? Investigating WebAPKs on Android
https://www.cclsolutionsgroup.com/post/when-is-an-app-not-an-app-investigating-webapks-on-android

-mr. eerie Blog
https://mreerie.com/2024/09/30/exploring-ufade-to-extract-data-from-ios-devices/

-Learn With Hexordia Launch
https://learn.hexordia.com

-Noel Lowdon-Vehicle Systems Forensics
https://www.linkedin.com/in/noel-lowdon-74685769/

-Not Scary Binary
https://us02web.zoom.us/webinar/register/WN_8G0VMawERVO-kpaDJbE2Ww#/registration

-Marco Neumann added Withings HealthMate on iOS (iLEAPP)
https://bebinary4n6.blogspot.com/2024/09/withings-healthmate-on-ios.html

Recognizing excellence is key in our community, and we spotlight the SANS Difference Maker Awards and Cellebrite Summit Digital Justice Awards. Discover why it’s crucial to nominate your peers and learn about the newly opened registration for IACIS 2025 training classes, featuring must-attend courses like Advanced Mobile Device Forensics. 

While highlighting a recent article by Brett Shavers, we stress the significance of continuous education and community acknowledgment in helping digital forensics professionals grow and excel.

Our conversation delves into the technical challenges of iOS Telegram data analysis and the development of tools like Kathryn Hedley's Parse USBs script. We shed light on the importance of peer reviews and cognitive bias in forensics. This episode is a deep dive into the intricacies of digital forensics, education, and the community that drives it forward.

Notes:

SANS Difference Maker Awards 
https://www.sans.org/about/awards/difference-makers/

Cellebrite Summit Digital Justice awards
https://cellebrite.com/en/c2c-summit-digital-justice-awards/

IACIS 2025 Training
https://iacis.com/training/

Belkasoft - iOS Telegram Acquisition and Database Analysis
 https://belkasoft.com/ios-telegram-forensics-acquisition-and-database-analysis

Kathryn Hedley parseusbs script
https://www.khyrenz.com/post/automated-usb-artefact-parsing-from-the-registryhttps://github.com/khyrenz/parseusbs

Cracking OneDrives Personal Vault -Brian Maloney
https://malwaremaloney.blogspot.com/2024/09/cracking-onedrives-personal-vault.html
https://github.com/Beercow/Personal-Vault-BEK

Brett Shavers New Article - Today, today I rant
https://www.linkedin.com/pulse/today-i-rant-dfir-training-brett-shavers--pij4c/

Lionel Notari Logs of the Week
https://www.ios-unifiedlogs.com/unifiedlogoftheweek

What's the real impact of AI on law enforcement documentation? Can digital forensics tools truly revolutionize our investigative processes? These are just some of the provocative questions we tackle in our season two premiere of Digital Forensics Now! Join us as we celebrate our one-year anniversary with reflections on the past year, exciting updates, and plans for the future. 

The episode takes a deep dive into the ethical and practical implications of AI in law enforcement, sparked by a recent AP News article on police officers using AI chatbots for writing crime reports. We express our skepticism about AI's accuracy and discuss the vital need for human oversight. Examining AI’s influence on officers' recollection of events, this episode scrutinizes the potential pitfalls and ethical concerns associated with AI in policing. We also humorously critique some AI-generated descriptions of our podcast, shedding light on AI's current limitations and biases.

Don't forget to vote for your favorite difference makers with the SANS Difference Maker Awards!

In the latter part of the show, we shine a spotlight on Recuperabit, a forensic file system reconstruction tool, and Lionel Notari's invaluable contributions on iOS log files. We tackle the challenges of modifying third-party tools and discuss the broader ethical concerns of reverse engineering. As we wrap up, we celebrate our anniversary by announcing the winners of our prize draw and featuring the "Meme of the Week," which humorously highlights the financial struggles in our field. Tune in for an informative and engaging episode!

Notes-
Local Storage and Session Storage in Mozilla FireFox Part 1
https://www.cclsolutionsgroup.com/post/local-storage-and-session-storage-in-mozilla-firefox-part-1

SANS Difference Maker Awards
https://www.sans.org/about/awards/difference-makers/

Police officers are starting to use AI chatbots to write crime reports. Will they hold up in court?
https://apnews.com/article/ai-writes-police-reports-axon-body-cameras-chatgpt-a24d1502b53faae4be0dac069243f418

Magnet Forensics acquires Medex Forensics
https://www.magnetforensics.com/news/magnet-forensics-acquires-medex-forensics-strengthening-video-evidence-integrity-with-detection-of-deepfakes-and-generative-ai/

RecuperaBit Forensic File System Reconstruction
https://www.forensicfocus.com/interviews/andrea-lazzarotto-digital-forensics-consultant-and-developer/https://github.com/Lazza/RecuperaBit

The Logs of the Week
https://www.ios-unifiedlogs.com/unifiedlogoftheweek

(THIS IS WHAT AN AI GENERATED DESCRIPTION WITH NO HUMAN CORRECTIONS WILL PROVIDE FOR YOU! SO NATURALLY WE HAD TO KEEP IT HAHA!)

What happens when a digital forensics expert sets up a podcast studio in a cupboard under the stairs and a co-host becomes a modern-day Snow White with her Bird Buddy camera? You get a lively and engaging episode of the Digital Forensics Now podcast! Alexis Brignoni, aka Briggs, and Heather Charpentier kick off this special episode with humor and camaraderie, sharing personal anecdotes and giving shout outs to their devoted listeners like Adam and Kevin. Plus, we nod to fellow podcaster Justin Tolman for his enlightening episodes on forensic technology, including a riveting discussion on AI and legal standards with Brandon Epstein.

Ever wondered how driving on the opposite side of the road or discovering local flavors like Vegemite could become part of a professional journey? This episode takes you on an entertaining trip to New Zealand, where Alexis recounts his experiences teaching at a New Zealand Customs event alongside experts like Jung Son and Mario Merendon. From navigating tiny light switches to marveling at Auckland’s architectural wonders, this chapter is filled with both professional insights and delightful cultural encounters. The rooftop bar with waist-high glass bumps offering views into the train station below is a highlight not to be missed!

For our tech-savvy listeners, we dive deep into the world of digital forensics tools and training. We discuss the significance of volunteering for IACIS, troubleshoot  Magnet Axiom software, and outline upcoming training events like the SANS Community Learning Day in Miami. We also explore the practicalities of running Python scripts, showcasing a new tool called Mister Skinnylegs, caution against over-reliance on AI, and stress the importance of fundamental knowledge in digital forensics. From iOS tool updates and Metadata Forensics to sourcing forensic-related blogs, this episode is packed with valuable insights to enhance your forensic expertise.

Notes:
DFIRCON xLEAPP
https://www.sans.org/mlp/dfircon-miami-agenda/

CCL Solutions Group - Mister Skinnylegs
https://github.com/cclgroupltd/mister-skinnylegs

iOS 17- The “Forever” Setting That Isn’t… Or Is It?
https://smarterforensics.com/2024/08/ios-17-the-forever-setting-that-isnt-or-is-it/

Identity Lookup Service
https://djangofaiola.blogspot.com/2024/08/identity-lookup-service.html

Welcome back to another episode of the Digital Forensics Now podcast! In this episode, we explore the critical need for continuous learning in the field, discuss fascinating forensic tools, showcase UFADE with its new chat capture feature, and engage in a spirited debate on the value of certifications. Get ready to expand your knowledge and stay at the forefront of this ever-evolving industry.

We begin by discussing the intricacies of unconscious and conscious incompetence as outlined in Brett Shavers new article. The episode continues with a detailed demonstration of UFADE, created by Christian Peter highlighting its user-friendly interface and the new chat capture feature. The hosts walk you through the tool's capabilities, showcasing its accessibility and usefulness in digital forensics investigations. From breaking Windows logon passwords using a Raspberry Pi Zero W to exploring the distinction between exploratory and explanatory data analysis, this segment offers a wealth of knowledge and practical insights. We also touch on the value of certifications, sparking a lively debate that challenges conventional wisdom and invites listeners to question the true measure of expertise in the tech industry. Get ready to be engaged in this thought-provoking episode.

Notes-
DFIR Competence: Are you Truly Skilled or Just Fooling Yourself?
https://www.dfir.training/blog/dfir-competence-are-you-truly-skilled-or-just-fooling-yourself

Oxygen Forensics Call for Speakers at the 2024 International User Summit
https://oxygenforensics.com/en/call-for-speakers-user-summit/

UFADE Updates
https://github.com/prosch88/UFADE

P4WNP1 Build
https://lush-seeder-8ab.notion.site/P4WNP1-Build-54ffcdbe7cdf4e74b47861e9bd80f857

SANS Webcast Series
https://www.sans.org/webcasts/demystifying-data-conversion-binary-hexadecimal-decimal-ascii/

Bitlocker on by Default Windows 11
https://www.tomshardware.com/software/windows/windows-11-24h2-will-enable-bitlocker-encryption-for-everyone-happens-on-both-clean-installs-and-reinstalls

ChatGPT 
https://www.sciencedirect.com/science/article/pii/S2666281724001252?dgcid=author

Join us as we recount our recent travels to Argentina and the Techno Security & Digital Forensics conference. We'll share the highlights of our trips before diving into the core content.

What could possibly go wrong with a feature designed for user convenience? We'll scrutinize Microsoft's controversial "Recall" feature, exploring its significant privacy concerns and implications for digital forensics. From unencrypted data to automatic opt-ins, we speculate on the potential user backlash. We'll also dive into the latest tech updates, including CCL Solutions Group's enhancements to the Rabbit Hole tool and how these advancements can revolutionize data analysis processes.

Discover the capabilities of VFC from MD5 and the latest tools for examining data from platforms like Snapchat and Facebook. We'll introduce new and updated blogs, innovative Python scripts, and the latest additions to the LEAPPS in this packed episode. Stick around for an insightful discussion and a sneak peek at what's coming in future episodes.

Notes- 
Rabbit Hole Updates and SQLite Blog/Cheatsheet
https://vimeo.com/948752153
https://www.cclsolutionsgroup.com/post/time-travelling-with-sqlite-journals-and-wal
https://vimeo.com/953570512
https://cdn.prod.website-files.com/5f02f2c93eab87a6ea84e2f3/665ed5e6ec5ef877d9d74dd2_sqlite-journal-cheatsheet.pdf

Copilot+ Recall disaster & Forensic Applications of Microsoft Recall 
https://doublepulsar.com/recall-stealing-everything-youve-ever-typed-or-viewed-on-your-own-windows-pc-is-now-possible-da3e12e9465e
https://cybercx.com.au/blog/forensic-applications-of-microsoft-recall/

Rising Star Jeremy McBroom
https://yeahihaveaquestion.com/

Analysis of Browser Artefacts from File Sharing Services
https://us5.campaign-archive.com/?u=a5a2a1131e612711f02b96e2c&id=9555c3f865
https://github.com/cclgroupltd/ccl_chromium_reader

SQLite Freelist Page Checker
https://github.com/SpyderForensics/SQLite_Forensics

Forensics StartMe Page
https://start.me/p/q6mw4Q/forensics?locale=en

Join us for an engaging session where we'll recap recent events and activities before diving into the latest research, cutting-edge tools, and exciting updates!

Tune in as we explore groundbreaking research conducted by emerging stars in the DFIR community. We'll delve into the testing of data stored in iOS Unified Logs, focusing on driving and motion states—this is sure to be fascinating. Discover the newly documented multi-user/multi-account functionality, such as Samsung's Dual Messenger, uncovered by a newcomer to digital forensics. Stay informed about enhancements and new capabilities for tools like UFADE.

We'll also ponder the implications of significant market acquisitions, such as Thoma Bravo's, and discuss their potential impact on the digital forensics field.

Additionally, learn about Android's innovative anti-theft features designed to thwart device thieves, which will also have implications for forensic investigations.

This episode is packed with insights you won't want to miss!

Notes-
iOS Unified Logs - Driving and Motion States
https://www.ios-unifiedlogs.com/post/ios-unified-logs-driving

Thoma Bravo Announces a Cash Offer to Acquire Cybersecurity Leader Darktrace
https://www.thomabravo.com/press-releases/thoma-bravo-announces-a-cash-offer-to-acquire-cybersecurity-leader-darktrace

Magnet One
https://www.magnetforensics.com/products/magnet-one/

UFADE Updates
https://github.com/prosch88/UFADE/

Android’s Theft Protection Features Keep Your Device and Data Safe
https://blog.google/products/android/android-theft-protection/

CCL Updates
https://github.com/cclgroupltd/ccl-segb

Brian Hempsteads Work on the Session Application
https://www.linkedin.com/posts/bhempstead_a-guide-for-session-app-sqlite-database-navigation-activity-7196877311659446272-zebu

Phil Hagen YouTube Channel
https://www.youtube.com/@PhilHagen

VMware Fusion Pro: Now Available Free for Personal Use
https://blogs.vmware.com/teamfusion/2024/05/fusion-pro-now-available-free-for-personal-use.html
https://unexploredterritory.tech/074-newsflash-vmware-workstation-and-fusion-licensing-changes-did-i-hear-free/

Live from the International Association of Computer Investigative Specialists (IACIS) with special guest Bill "the phone wizard" Aycock!!


Notes:
Three New SANS Posters
https://www.sans.org/posters/ios-third-party-apps-forensics-reference-guide-poster/
https://www.sans.org/posters/android-third-party-apps-forensics/https://www.sans.org/posters/dfir-advanced-smartphone-forensics/

New Release of Mushy
https://doubleblak.com/app.php?id=Mushy

Blue Crew Forensics
https://bluecrewforensics.com/2022/03/07/ios-app-intents/

Navigating the complexities of digital forensics can be daunting, but this week we've got your back with the exploration of Magnet Forensics' Axiom version 8, and its transformative Mobile View feature. As your hosts we're not just sharing tech updates; we're discussing the impact these tools have on our work and how they shape the narratives we construct. 

When it comes to the integrity of an investigation, the devil is in the details—and in the documentation. We delve into the craft of forensic reporting, dissecting why an analyst's narrative is just as critical as the raw data pulled from tools. From the subtleties of crafting a timeline to the nuances of articulating the relevance of each artifact, we've got the insights that will assist you on your report writing journey. 

Finally, join us for a celebration of the community spirit that fuels this field, illustrated by new blogs and newly supported artifacts in the LEAPPS. We also look at the growing significance of vehicle forensics in investigations. And because we all need a good chuckle, don't miss our 'meme of the week' segment. It's an episode brimming with expertise, but not without its moments of laughter because finding joy in our work is paramount. Come for the knowledge, stay for the camaraderie, and enhance your forensic acumen with us.

Notes-
Job Alert- Upcoming Openings at the New York State Police
https://troopers.ny.gov/civilian-employment

Capture the Flags
Hexordia
https://www.hexordia.com/spring2024-weekly-ctf-challenge
Oxygen
https://oxygenforensics.com/en/training/events/ctf-apr-19-2024/
Belkasoft
https://belkasoft.com/belkactf6/info

Mobile View and Copilot in Magnet Axiom
https://www.magnetforensics.com/blog/bring-your-mobile-evidence-to-life-with-the-new-mobile-view-in-magnet-axiom/
https://www.magnetforensics.com/blog/identify-deepfakes-and-quickly-surface-evidence-with-new-ai-tools-in-magnet-axiom/

DeRR.p. Investigating Power Events on Samsung Devices
https://thebinaryhick.blog/2024/04/07/__trashed/

Peer Review Checklist
https://www.hexordia.com/blog-1-1/gc0vnvj80ogwx724ovu7avzwvjl742

What's the Buz: Forensic Analysis of Buz for iOS
https://laurora4n6.wixsite.com/aurora4n6/post/what-s-the-buz

What's New with the LEAPPS?
https://www.stark4n6.com/2024/04/splitwise-on-ios.html

In mobile forensics, with each update brings new challenges and opportunities. Join us as we dissect the latest iOS 17.4 impacts, including the nuances of SQLite databases and the advent of write-ahead logs in Advanced Logical extractions. Our episode is brimming with insights that could change the way you approach data extraction and parsing. 

The forensic landscape is ever-evolving, and this episode isn't shy about the hurdles we face, or the workarounds that keep us ahead. Discover how matching forensic work environments with devices' native operating systems and utilizing tools like Christian Perter's  and Lionel Notari's for Logical and Unified Log extraction can streamline your investigative processes. 

Building a personal brand in digital forensics isn't just about notoriety; it's about cultivating a reputation that commands respect and opens doors. This episode celebrates those who contribute to the community, from the creation of new parsers to the latest features in FTK 8, and how these actions bolster not just your standing but the entire field. We explore the unique journeys that shape our professional identities and share laughter over common forensics foibles. It's an episode that champions growth, community, and the personal touch that makes all the difference in a technical world.

Notes-
A Gift From Apple:
https://www.msab.com/blog/apple-deleted-data-itunes-backups/

UFADE Universal Forensic Apple Device Extractor:
https://github.com/prosch88/UFADE

iOS Unified Logs tool:
https://www.ios-unifiedlogs.com/blog

FTK LevelDB Support:
https://www.exterro.com/ftk-product-downloads

What's New with the LEAPPS?
https://github.com/abrignoni

Unlock the secrets of advanced forensic analysis with us! We reveal essential training classes that every digital sleuth needs to stay ahead in an ever-changing tech landscape. Sign-on to be enlightened by experts in the captivating world of data structures through Hexordia's class and IACIS's comprehensive course.  But it's not all about the classes; we're also sending a must-read book your way to sharpen that detective wit you pride yourself on. 

Get ready to explore the controversial yet fascinating realm of facial recognition with our introduction of Exponent Faces, a  X-Ways Forensics X-Tension. Whether it's identifying suspects or navigating the ethical minefields of biometric data, we're weighing in with all the expertise you could hope for. 

Finally, journey with us as we dissect the pivotal role of soft skills and community support for forensic examiners, you'll find this episode is not just about the tech—it's about the people behind the screens who make justice possible. Join us, where knowledge is power and staying updated is as crucial as the evidence itself.

Notes:
IACIS Advanced Mobile Device Forensics
https://www.iacis.com/training/amdf-advanced-mobile-device-forensics/

DFIR Investigative Mindset-Brett Shavers
Book release March 22, 2024- 1/2 price for one week!

Facial Recognition in DFIR
https://www.apiforensics.com/blogs/announcing-exponent-faces.asp
https://abcnews.go.com/Business/controversy-illuminates-rise-facial-recognition-private-sector/story?id=96116545

Google Chrome Platform Notification Analysis
https://www.sans.org/blog/google-chrome-platform-notification-analysis/

The Digital Forensic Practitioner Survey (DFPulse2024)
https://bit.ly/dfpulse

What's New with the LEAPPs?
https://github.com/abrignoni

Embark on a journey through both history and the cutting-edge world of digital forensics with us as we pay homage to the brilliant Dr. Gladys West, whose work underpins the GPS technology we take for granted today. In celebration of Black History Month, we draw inspiration from Dr. Martin Luther King Jr., discussing how we can all contribute to the fight against enduring societal challenges. Our conversation is a testament to the power of empathy and action in fostering societal change, spotlighting the often overlooked breadth of achievements by historical figures like Dr. West and Dr. King.

Unravel the complexities of iOS location and  Unified Log analysis through our educational talk on the recent breakthroughs highlighted by experts like Ian Whiffin and Lionel Notari. Discover the new feature from Magnet Axiom. The Animated Map Routes feature provides an additional facet for courtroom presentation. 

We wrap up with a deep appreciation for the significance of training and expertise in digital forensics, engaging with the thoughts presented by Shafik Punja in his 'Bullshit Hunting: Digital Forensics Edition' article. The discussion traverses the critical role of proper forensic training and tools, the ethical responsibilities that accompany our work, and the profound impact that our industry has on legal outcomes and lives. 


Notes-

The Cyber Social Hub- Daily Digital Investigator Episodes
https://podcast.cybersocialhub.com/

Belkasoft's Free Android Forensics Class
https://belkasoft.com/android-forensics-training

Apple Maps - Visited Location?
https://www.doubleblak.com/blogPost.php?k=mapssync

iOS Unified Logs - WiFi and AirPlane Mode
https://www.ios-unifiedlogs.com/post/ios-unified-logs-wifi-and-airplane-mode

Animated Map Routes in Magnet Axiom
https://www.youtube.com/watch?v=fyPrJKLhD9k

8 Log Files You Can Collect from iOS and Android Devices
https://www.magnetforensics.com/blog/8-log-files-you-can-collect-from-ios-and-android-devices/

Candidate Examiner's and Training Programs
https://www.bullshithunting.com/p/bullshit-hunting-digital-forensics

Sources of Error in Digital Forensics
https://www.sciencedirect.com/science/article/pii/S2666281724000027

Discover the intersection of digital innovation and forensic expertise as we celebrate and honor the incredible legacy of computing pioneer Mark Dean during Black History Month. With a salute to unsung heroes like Johann, who fuel the open-source tools we rely on, this episode is a tribute to the collaborative spirit that propels digital forensics forward.

Peek behind the curtain of the Photos SQLite database with insights from the Forensic Scooter blog, uncovering the depths of data crucial to forensic investigations. We explore how metadata comparison can reveal content manipulation, the importance of distinguishing between cloud and device media origins, and the crafty skills required to validate findings in a world where AI is becoming a pivotal tool. This episode isn't just about the tools we use; it's about the critical thinking and validation skills necessary to ensure AI assists rather than misleads.

Fasten your seatbelt as we navigate the evolving landscape of vehicle forensics and tackle the challenges posed by encryption in new vehicle modules. Reflect on how data from vehicle systems can be leveraged in accident reconstruction and criminal investigations, emphasizing the need to stay ahead of technological advancements. Wrapping up, we delve into the latest from the LEAPPs framework and the implications of Android's multi-user support, underscoring the episode's commitment to sharing knowledge that keeps the digital forensics community at the cutting edge.

Notes-
Black History Month Notable Contributor to Digital Forensics-Mark Dean
https://web.eecs.utk.edu/~markdean/

Device Set-up – Transferring data to new iPhone & Effects to Photos.sqlite
https://theforensicscooter.com/2024/02/04/device-setup-transferring-data-to-new-iphone-effects-to-photos-sqlite/

Dissecting the Android WiFiConfigStore.xml for Forensic Analysis
https://blog.digital-forensics.it/2024/02/dissecting-android-wificonfigstorexml.html

AI Generated Imagery
https://us5.campaign-archive.com/?u=a5a2a1131e612711f02b96e2c&id=81d1b025e7

Magnet Idea Lab-Project Goose
https://magnetidealab.com/projects/project-goose/

Vehicle Forensics
How to access logical files in a QNX partition-   https://www.youtube.com/watch?v=8SAZthXjT5s

The LEAPPS
https://github.com/abrignoni

Embark on an enlightening path as we meld the celebration of Black History Month with the dynamism of mobile forensics. This episode is a tribute not only to the past but a clarion call for the future, as we honor Annie Easley, the trailblazing NASA computer scientist, while also navigating the rapidly evolving landscape of digital investigation tools. As your guides, we unravel the intricacies of open-source forensics tools, and the necessity of test devices, ensuring your knowledge remains at the forefront of technological advancements.

With a constant eye on professional growth, we're excited to share information about upcoming conferences, training and opportunities to sharpen your digital forensic skills. We share our experiences, opening doors for you to learn and grow right beside us. Our conversation takes a stimulating turn as we discuss the Rabbit R1, a new AI gadget that promises to redefine app interaction and its implications for data privacy. As we dissect the nuances of AI in fingerprint analysis, we invite you to journey with us through the maze of modern forensics, where even the uniqueness of fingerprints is called into question.

As we wrap up, our passion for the subject matter shines through with the introduction of cutting-edge features in mobile forensics updates, and the vital role of resource management in our field. We laugh over the meme of the week but also reflect on the serious undertones it brings to the prioritization of forensic cases. Closing the session, we express our heartfelt gratitude for the engagement and support that fuels our podcast, leaving you with an anticipation for deeper discussions and discoveries in the episodes to come. Join us, and together, let's shape the narrative of digital forensics and its rich connection to history and innovation.

Notes-
Honoring Annie Easley-Black History Month Feb 2024
https://elective.collegeboard.org/annie-easley-computer-science-pioneer

Testing and Validation
https://www.hexordia.com/blog-1-1/unlock-rooting-pixel6a
https://blog.d204n6.com/2020/08/setting-up-testing-lab-of-ios-and.html

Paraben Forensic Innovation Conference
https://pfic-conference.com/

Free Android Training from Belkasoft
https://belkasoft.com/android-forensics-training

Cellebrite Case to Closure Summit and Awards 
https://global-c2c-summit-2024.cventevents.com/event/ec371a30-107d-4ce4-8bad-44e331148339/summary
https://cellebrite.com/en/c2c-summit-digital-justice-awards/

Magnet Virtual Summit/Capture the Flag
https://magnetvirtualsummit.com/
https://magnetvirtualsummit.com/capture-the-flag/

Rabbit R1
https://www.theverge.com/2024/1/9/24030667/rabbit-r1-ai-action-model-price-release-date

AI- Fingerprints Unique or Maybe Not?
https://www.cnn.com/2024/01/12/world/fingerprints-ai-based-study-scn/index.html

Layoffs Due to AI
https://www.theverge.com/2024/1/14/24038397/google-layoffs-just-the-beginning

Hidden Gem in iOS 17
https://www.linkedin.com/posts/luca-cadonici-41299b4b_ios-ipados-passcode-activity-7152770642168160257-VJ7C

Android Auto Reboots
https://www.bleepingcomputer.com/news/security/grapheneos-frequent-android-auto-reboots-block-firmware-exploits/

The LEAPPS
https://github.com/abrignoni

Get ready to navigate the complexities of digital forensics with the latest industry insights, as we shine a light on Cellebrite's recent rebranding journey. From the quirky 'EYE' twist in their new product names to the strategic significance behind the move, we've got it all covered in a dynamic discussion that promises to clarify and critique the changes afoot. Plus, we'll dive into how Cellebrite is contributing to the tireless work of child protection organizations, aligning tech advancements with noble missions.

We will guide you through our thoughts relating to advertising effectiveness in the forensics domain, and why the quality work of forensic professionals trumps any single tool on the market. The art of communication from businesses about their products and the role of technology in boosting company progression is key.       

The conversation turns to the exciting potential of recent password recovery innovations from Arsenal Recon's Password Sledgehammer and new support for location based and messaging applications in the LEAPPs!

As we wrap up, the discussion turns to the thrilling possibilities of Android device analysis and the ever-evolving policies of giants like Google. We're not just talking about the next big thing; we're living it, breathing it, and sharing our experiences with you. So plug in, turn up the volume, and prepare for an episode that’s as informative as it is engaging.

Notes:

Operation Find Them All-
https://abcnews-go-com.cdn.ampproject.org/c/s/abcnews.go.com/amp/Business/wireStory/cellebrite-donates-ai-investigative-tools-nonprofits-find-missing-106321858

Magnet Forensics Acquires High Peaks Cyber-
https://forensicfocus.com/news/magnet-forensics-acquires-high-peaks-cyber-further-bolstering-the-magnet-graykey-labs-research-team/

Arsenal Password Sledgehammer-
https://arsenalrecon.com/products/arsenal-image-mounter/downloads

Life360 Stark4N6-
https://www.stark4n6.com/

Analysis of Android Settings During a Forensic Investigation-
https://blog.digital-forensics.it/2024/01/analysis-of-android-settings-during.html

Google Location Data News!-
https://www.forbes.com/sites/cyrusfarivar/2023/12/14/google-just-killed-geofence-warrants-police-location-data/?sh=245f8f422c86

https://www.washingtonpost.com/technology/2023/12/14/google-maps-location-history/

Ever found yourself piecing together a complex jigsaw puzzle of digital evidence? That's precisely the journey we invite you to embark on in our latest episode packed with tools, tales, and tech. We're not just talking shop; we're handing you the magnifying glass to examine the intricacies of JSON files with JSON CRACK, and introducing a  python tool to automate investigations involving Google Drive File Stream artifacts, DriveFS-sleuth.

This episode is a testament to the craft of digital forensics, featuring a blog from Mattia at Zena Forensics that aides in answering the question, "Has the user ever used the XYZ application?".  As we unpack the nuances of reverse engineering and celebrate the updates to Hexordia's Evanole, we're reminded that the heart of digital forensics beats to the rhythm of relentless inquiry and meticulous method. 

We delve into the advanced research and exploitation methodologies With Magnet GrayKey Labs and converse about the importance of these capabilities as well as validation. This is coupled with a live demonstration involving SEGB files and the data that can be overlooked without research and the validation of multiple tools.

Raise your glasses—here's to the exuberant spirit of learning and the relentless pursuit of truth that defines our community.  So, are you ready to elevate your understanding of the digital landscape and smash those New Year's resolutions? Join us, and let's make 2024 a year of 4K clarity—in forensics and beyond!

Notes:

JSON Crack-
https://jsoncrack.com/

DriveFS Sleuth — Your Ultimate Google Drive File Stream Investigator!
https://amgedwageh.medium.com/drivefs-sleuth-investigating-google-drive-file-streams-disk-artifacts-0b5ea637c980https://github.com/AmgdGocha/DriveFS-Sleuth

Advanced Research and Exploitation Methodologies With Magnet GRAYKEY Labs
https://www.magnetforensics.com/blog/advanced-research-and-exploitation-methodologies-with-magnet-graykey-labs/

Has the user ever used the XYZ application?
https://blog.digital-forensics.it/2023/12/has-user-ever-used-xyz-application-aka.html

Evanole New Year Reveal! 
https://www.hexordia.com/evanolece

Ever thought about the thin line between privacy and morality? Well, join us, , as we deep-dive into the ethical complexities surrounding this issue in today’s digital age. We bring to you exciting updates from a recent workshop in Panama, where enlightening exchanges with digital forensics experts from all over the world were had.

Our exploration takes us through the workings of XRY and XRY Pro, as well as RAMDCoder, a game-changer in analyzing memory dumps from Android devices. We'll show you just how to navigate this tool, offering a glimpse into the future with the upcoming updates that promise to revolutionize device profiling. Intriguing, isn't it? Get ready as we take on mobile device  forensics, focusing on the Samsung Galaxy S21 Ultra, and the treasure trove of data within its RAM. Learn from our experiences, including how we recovered from missing a crucial step in the extraction process. Oooops user error strikes again!

As we wrap up, we'll discuss phishing attacks and the crucial role organizations play in preventing them. We believe in the power of research and validation, especially in the digital forensics field. We’ll also share insights from Jessica Hyde of Hexordia, underscoring the importance of peer-reviewed research in our field. Get a good laugh as we humorously compare Apple to Darth Vader, highlighting the challenges they present for forensic examiners. SEGB for the WIN! This is an episode that you will not want to miss!

Notes:

Chat encryption: A moral responsibility or a moral abdication?
https://arstechnica.com/tech-policy/2023/12/meta-defies-fbi-opposition-to-encryption-brings-e2ee-to-facebook-messenger/

What makes epoch timestamps tick?
https://www.cclsolutionsgroup.com/post/what-makes-epoch-timestamps-tick
CheatSheet: https://assets-global.website-files.com/5f02f2c93eab87a6ea84e2f3/656da27da36e0c5cd1715d8a_EpochCheatsheet.pdf

MSAB XRY:
https://www.msab.com/

BrowserState.db last_visited_time?
https://doubleblak.com/beta/browserstate

SEGB Parsers!
https://github.com/cclgroupltd/ccl-segb

Get ready to journey into the world of digital forensics as we share our insights on the crucial art of utilizing a diverse range of tools. A single tool just won't cut it, and reliance on just one could cause you to miss out on important finds. We also give our listeners the floor, inviting you to voice your thoughts on the IACIS Advanced Mobile Device Forensics class, and the topics you'd love to see covered. 

How do you feel about forensic extraction tools? We dissect unique features of tools like duplicators, TX1, and Atrio, and dive into latest updates from OpenText and ArcPoint Forensics. These updates have made it possible to create Android and iOS backups using duplicators, a game changer in the field. With Atrio, we open up an intriguing discussion about their forensic triaging and AI capabilities. We discuss the role of AI in identifying CSAM and brainstorm ways to enhance the tooling.

 We share our own learning experiences from various classes, highlighting the absolute necessity of continual learning and outside research in this ever-evolving field.  We also explore the features and potential of Arsenal, a digital forensics tool which aids in mounting and virtualizing E01 images. The unique capabilities provided by Arsenal to bypass the password to a Windows logon screen and access DPAPI-protected data is a must try! Whether you're a seasoned expert or just dipping your toes in the water, this episode is sure to pique your interest in the vast world of digital forensics.

Notes-
IACIS Advanced Mobile Device Forensics (AMDF)
https://iacis.com/training/amdf-advanced-mobile-device-forensics/

OpenText Duplicator Update
https://www.youtube.com/watch?v=L3qGa7H6NBs

ArcPoint Forensics
https://www.arcpointforensics.com/

DFIR Diva-
https://dfirdiva.com/

Arsenal Recon-
https://arsenalrecon.com/

Hexordia Mobile Data Structure-Virtual Live Training-
https://academy.cyber5w.com/courses/hexordia-mobile-data-structures-dec-2023

 We are back with a mind-boggling conversation about our experiences, and the ever-evolving face of digital forensics. We're going to share some personal anecdotes, enlighten you about the changing UNIX epoch timestamp, and even discuss how we cope with the advancing age in this fast-paced world.

In the digital world, knowledge is power. We will reveal an amazing cheat sheet from Cellebrite that will simplify your understanding of extractions and the data that they yield. We’ll also delve into the concept of tool transparency, highlighting the pros and cons that come with it. We’ll help you understand why it's crucial to be informed about known bugs in a tool, and navigate the complex process of bug reporting. We’re going to discuss why it's essential to have multiple tools in your arsenal for data validation, and how manual validation is a must when it relates to key evidence.

As we wrap up, we'll talk about the implementation of ALEAPP and iLEAPP in Paraben and its capabilities to choose artifacts to report on. To add some levity, we'll also share a humorous meme that perfectly captures the essence of the repercussions of failing to validate your digital data. So, prepare to embark on a journey that’s bound to make you rethink everything you know about data extraction and tooling analysis.

Notes-
Scholarship Reminders
-https://www.iacis.com/will-docken-scholarship/

-https://www.iacis.com/womens-scholarship/

-https://www.magnetforensics.com/blog/2023-magnet-forensics-scholarship-program-apply-today/

Cellebrite Data Extraction CheatSheet
-https://www.linkedin.com/posts/heather-mahalik-cellebrite_data-extraction-cheatsheet-activity-7125138491805462528-l5-5/

-https://cellebrite.com/en/episode-23-i-beg-to-dfir-data-extractions-explained-ffs-afu-bfu-advanced-logical-digital-forensics-webinar/

Paraben
-https://paraben.com

Curious about how digital forensics can unlock the secrets held by your tech devices? Join us as we shine a light on RabbitHole, an ingenious tool devised by Alex Caithness of CCL Solutions Group. This episode is sure to be a revelation, as we delve into this unique amalgamation of data format viewers. The plot thickens as we, act as your guides, to dissect the complexities of the RabbitHole - reparse feature, the free form report builder, and the remarkable ability to extract data from various sources. 

We step away from the tech talk for a moment to underline the crucial role of Moot Court in nurturing digital forensics examiners. We debate the need for a supportive environment that allows mistakes, honing professionals in the field. We discuss the highlights of what qualities are needed to shape a great witness and throw light on two free cybersecurity courses related to expert witness testimony.

Don't miss our discussion on the new additions to iLEAPP! Media events from the knowledgeC database and connecting Discord attachments to message threads. 

Finally we discuss  changes to Shellbag artifacts that were implemented in Windows 11 updates as outlined by 13Cubed, and the meme of the week!

So, are you ready to tumble down this fascinating digital RabbitHole with us?

Notes:
CCL Solutions-RabbitHole-
https://www.cclsolutionsgroup.com/forensic-products/rabbithole

Courtroom Testimony Trainings-
CYBRARY.IT- 
https://cybrary.it/course/dfir-investigations-and-witness-testimony
NW3C-DF501 Expert Witness Testimony - Digital Forensic Examiners- https://www.nw3c.org/UI/CourseCatalog.html

Connecting Discord Attachments to Message Threads-
https://bluecrewforensics.com/2023/10/30/connecting-discord-attachments-threads-sdwebimage-library/

13 Cubed: An Important Change to ShellBags - Windows 11 2023 Update!
https://www.youtube.com/watch?v=M1nyMIu1Y18&t=4s

Shellbags Explorer by Eric Zimmerman
https://ericzimmerman.github.io/#!index.md

Ever wondered how to make the most of data analysis tools like iOS Spotlight Store DB and Realm Databases? We're here to share our experiences, tips, and favorite resources to help you elevate your data extraction skills. Join us, as we discuss the amazing work of Yogesh Khatri, the creator of a game-changing parser and as we guide you through the vast world of data extraction and analysis techniques.

We begin our journey with iOS Spotlight Store DB, revealing the treasures hidden within and how to use Yogesh's parser to uncover its secrets. We then navigate through Realm Databases, sharing our encounters with data stores and tools for parsing extracted data. We also share our personal workflow process, granting you a peek into our data analysis strategies. But we're not done yet. Our adventure takes a detour towards Google Maps Geolocation Artifacts, where we highlight the amazing work of The Binary Hick and his research of the audio files and geolocation points related to navigation.

Finally, we explore the nuanced art of analyzing timestamps and locations in images, revealing a fascinating intersection of data and intent. We share how we use Python scripts, manual offsets, and more to make data time-zone aware. Wrapping up our discussion, we emphasize the vitality of research in data analysis and the role of code in automation. So, buckle up for a thrilling ride into the mesmerizing world of data extraction and analysis. You'll come out the other side armed with fresh insights and new tools at your disposal.

Notes:

iOS Spotlight store.db:
https://github.com/ydkhatri/spotlight_parser

Realm Databases:
https://www.mongodb.com/docs/realm/studio/

The Binary Hick-Finding Phones with Google Maps:
https://thebinaryhick.blog/2023/10/17/finding-phones-with-google-maps-part-1-android/

iOS Media Adjustments:
https://www.doubleblak.com/blogPosts.php?id=23

Ready for the breakdown of the newest player in the mobile forensics field, FTK 8?  This latest release includes a facelift, enhanced mobile support, and a plethora of supportive features for mobile devices. From app-specific mobile artifacts like Discord, Facebook, Kik, Snapchat, WhatsApp, to calls, conversations, contacts, MMS, and SMS, FTK 8 is geared up. Plus, its Smart View tab provides new mini and super timeline features as well as enhancements to their multimedia view. 

Our chat extends beyond the merits of FTK 8 to the realm of portable cases and the case review aspect of all digital forensic tools. Uncover how the right network setup can boost review speed and why understanding the limitations of portable cases is crucial for examiners and stakeholders alike. We also discuss how focusing on artifact-based reviews, can enhance efficiency.  But that's not it! We also delve into the importance of data validation and why a user-friendly interface is key for people reviewing and examining cases.

Interested in hearing about comparative analysis? Tune in for an in-depth discussion about comparing the capabilities of one forensic tool to another and the possible outcomes of such a competitive assessment. 

New to iLEAPP? We've got you covered! Together, we unearth new artifacts like the last car connection and voicemail artifacts, even recently deleted (trashed) voicemail - critical elements that will revolutionize your review process. Understanding the significance of analyzing torrent data encoded in Bencode, linking media on a device to files used to acquire that media, is another key takeaway from our conversation. To wrap things up, we express our heartfelt gratitude to you, our listeners and thank you for joining us on this fascinating journey into the world of digital forensics.

Notes:

FTK 8
https://www.exterro.com/ftk-8-0

iOS 15 Image Forensics Analysis and Tools Comparison Project- 
https://blog.digital-forensics.it/2023/09/ios-15-image-forensics-analysis-and.html

LEAPPS
https://github.com/abrignoni

Stay tuned as we navigate the mesmerizing maze of digital forensics, sharing insights that you wouldn't want to miss! We kick-start this thrilling journey with a sneak-peek into the Regional Computer Forensics Lab in Boston. The fun doesn't stop here as we also delve into the exhilarating Cellebrite Capture the Flag challenge and touch upon the awe-inspiring Difference Makers Awards. 

We then turn to the indispensable resources for those wishing to take on the digital forensics world. From the empowering IACIS Women in Law Enforcement Scholarship to the unique Magnet Forensics Scholarship, we've got you covered. Don't miss our take on the complimentary Belkasoft iOS Forensics Course and DFIR Artifact Museum. Plus, we'll guide you through using the intriguing Eric Zimmerman's SQLECmd and Timeline Explorer.
 
 Finally, we discuss the invaluable act of giving back to the digital forensics community. We share the secrets of adjusting to corporate culture, continuing education, and the pivotal role of mentoring. We even touch upon the remarkable Digital Forensics Intern Program by Notre Dame. So, tune in as we unravel the complex world of digital forensics. What's more? We've got some valuable advice for newbies waiting at the end. Get ready to embark on this digital journey with us!

Notes:

Difference Makers Awards 2023: 
https://www.sans.org/about/awards/difference-makers/
IACIS Scholarship: 
https://www.iacis.com/will-docken-scholarship/
IACIS Women's Scholarship: 
https://www.iacis.com/womens-scholarship/

Magnet Scholarship: 
https://www.magnetforensics.com/blog/2023-magnet-forensics-scholarship-program-apply-today

Belkasoft iOS Free Training: 
https://belkasoft.com/ios-forensics-training

Eric Zimmerman's SQLECmd: 
https://ericzimmerman.github.io/#!index.md
DFIR Artifact Museum: 
https://github.com/AndrewRathbun/DFIRArtifactMuseum

J & L Forensics Blog: 
https://jnl4n6.com/2023/09/13/new-to-cyber-preston-mcnair/

Looking to level up your expertise in digital forensics? We promise this episode will arm you with actionable insights, strategies, and tools to sharpen your skills. Our conversation covers a wide spectrum of topics from the importance of conferences to the rising debate surrounding Apple's proposed scanning for CSAM material. We peel back the layers on forensic labs, discussing how to measure effectiveness, the role of leap artifacts in investigations, and the critical need for continual learning and collaboration.

In this episode, we navigate the various pathways to proficiency in digital forensics – whether that's through formal education like criminal justice degrees, on-the-job training, or the value of certifications. We explore the growing need for standardization in the field and the relevance of experience and research in establishing credibility. And let's not forget about Ryan Benson's Unfurl tool – we discuss its capabilities in breaking down URLs, a vital tool for digital forensics cases.

Lastly, we delve into the contentious subject of Apple's decision not to scan for CSAM material. We analyze the potential implications of such a move and the concerns raised by the Heat Initiative in their recent letter. Apple's reported cyber tip line reports are also put under the spotlight as we compare it to Google's numbers. From seasoned professionals to those just starting out, this episode promises to challenge your thinking, ignite debates, and bring you valuable tips and insights to help you stay ahead in the digital forensics field. Tune in for an enlightening and inspiring session!

Notes:
https://github.com/abrignoni/iLEAPP
https://dfir.blog/unfurl/
https://www.documentcloud.org/documents/23933180-apple-letter-to-heat-initiative
 

Hear the latest news on digital forensics with your hosts Alexis "Brigs" Brignoni & Heather Charpentier for the week of August 25, 2023.

Episode Notes:

• Magnet Forensics buys Griffeye
• Airtags in Android research by Josh Hickman: https://thebinaryhick.blog/2023/08/13/android-airtags-part-ii/
• 4Cast Awards - Winners
• Input Output + Syslog (iO+S)
  https://www.hexordia.com/blog-1-1/io-plus-s-tool-release
• Do we need access to source code to ensure fairness?
• Testing & Validation Document
  https://www.sans.org/blog/six-steps-to-successful-mobile-validation-paper/
• Targeted Extractions
• Meme time
• Comments: abrignoni@duck.com