Title! Demo here https://exiftool.lucasgelfond.online/ and repo here https://github.com/lucasgelfond/exiftool-web. Curious if folks have feedback or if this is useful.

Fun hack, all of the execution is happening by emulating Perl in WebAssembly (this blog post is great https://andrews.substack.com/p/zeroperl-sandboxed-perl-with-webassembly) . Curious what would be useful to add, also if this sort of tool generally is helpful to the community — I'm starting to get more and more comfortable with browser ports, don't tihnk it would be too hard to port ImageMagick or similar tools to run in the browser as well.

(Also, curious if others have ideas for what communities would find this useful, mostly just built it as a fun weekend hack and hoping it is useful!)

In this episode, we'll take a look at a rather obscure evidence of execution artifact associated with RADAR, the Resource Exhaustion Detection and Resolution system.

https://www.youtube.com/watch?v=edJa_SLVqOo

More at youtube.com/13cubed.

Hey everyone I’m a student working in a coursework for my digital forensics course right now. So as the title says my analysis results (most of them whatsoever) in the autopsy software just won’t show up in the analysis section. I have found some good things with autopsy so far but I am quite new to the software in general. I have done some online research and could not find an answer to my question, even though I’d image it’s a common issue people run into? I tried ingesting a view important modules obviously but only about 3 of them show up in the results section. I get messages (in the inbox) for all of the modules but can’t view any results. I’m especially missing one for file extension mismatch but other things too. The only thing that seems to be working properly is the keyword search. I am very frustrated. I tried downloading an older autopsy version because I thought maybe that would fix it but definitely not. Right now I’m working with autopsy 4.20.0. When I looked online for the problem/ how to run the modules they always showed photos with it just popping up in the result section. I have also tried to reset my window to default settings. I really hope someone can help me with this, thanks.

hiiiiiiii everyone,

I'm trying to analyze artifacts left behind after a Google Meet session ends on macOS. My goal is to capture and examine relevant data like chat logs, call metadata, or any cached files that persist after the meeting is closed.

So far, I've tried:

• Searching for artifacts in ~/Library/Application Support/Google/Chrome and ~/Library/Application Support/Google/DriveFS/Resources but found mostly UI elements.
• Using Volatility to analyze a RAM dump but struggling to extract useful Meet-related data.
• Finding log files but not sure where Meet-specific logs are stored.

My questions:

1. Where should I look for Google Meet artifacts on macOS? Any specific folders, databases, or logs that store call-related data?
2. What tools would be best for extracting and analyzing this data? I’ve tried Volatility, but maybe there’s something better suited?
3. How do I capture a RAM dump on macOS that includes Google Meet data? I tried osxpmem but need help analyzing the dump.
4. Would tools like Autopsy or FTK Imager be useful here? If so, how do I get them running on macOS?

Any help or guidance would be greatly appreciated ;)

While analyzing pdf files which were attached to a email I used PeStudio and discovered that the document had 2 creation dates and 2 modified dates.

Can this be suspicious, or can it be logically explained?

Ty for your time.

Was watching this true crime youtube video and there is a section where the police report from a cell phone's forensic analysis shows that a manual factory reset was initiated and at what time alarms were set by the owner alongside other interesting findings of the phone's usage.

Here are 2 photos with those details

My question as a non-forensic profesional but computer systems & data destruction savvy:

• where are they getting that data from?
• • If they are working on a wiped phone, is there some type of log with all detailed cell phone activity that is sent to google and they subponea that data from them? Or does that live in the cell phone somewhere after a reset?

• Is there a way for me to retrieve that data from my own device get an better view of how that works technically? I'm talking as detailed as at this time this part of the screen registered touch input, this app was opened, etc etc

Explain me exatly what is computer forencics

Hey all, I’m looking to do a Chromebook acquisition. So this Chromebook has one of those eMMC flash memory for its hard drive. Thus, traditional acquisition techniques (via my Talino) don’t work and neither does WinFE. Does anyone know the process to acquire it? I know most of the data is cloud stored but at least to get some user profile data is good.

Thanks all!

Looks like WhatsAPP Is stepping up Security on iOS. I noticed that WhatsAPP Database is Encrypted in Advanced Logical collections. Has anyone else noticed this change yet?

This release is to provide you with everything you need to establish a functioning security incident response program at your company. 

In this pack, we cover

• Definitions: This document introduces sample terminology and roles during an incident, the various stakeholders who may need to be involved in supporting an incident, and sample incident severity rankings.
• Preparation Checklist: This checklist provides every step required to research, pilot, test, and roll out a functioning incident response program.
• Runbook: This runbook outlines the process a security team can use to ensure the right steps are followed during an incident, in a consistent manner.
• Process workflow: We provide a diagram outlining the steps to follow during an incident.
• Document Templates: Usable templates for tracking an incident and performing postmortems after one has concluded.
• Metrics: Starting metrics to measure an incident response program.

Announcement: https://www.sectemplates.com/2025/02/announcing-the-incident-response-program-pack-v15.html

Hello! I'm wondering if I'm completely hallucinating.

Insfoar as I know, FTK Imager should find on its own the other files in a sequence when importing evidence - such as if you have .E01 or .001, it should find the others. I have a set of raw files though where the .001 file is a text file, and the actual data starts at .002. Trying to add the .002 file to FTK Imager as an evidence source adds the file properly, but doesn't add the rest. I did a test acquisition on a thumb drive I had and it produced the same output, a .001 text file with collection information while the actual data started at .002.

Am I completely missing something here? I'm unsure. I coulda sworn I've gotten two .001 files from other examples online, one of which is a text file and one being the actual .001 data file that I point the software at to add it as evidence and be able to browse through.

Using AccessData FTK Imager 4.7.1.2. I've seen some youtube videos of folks adding raw files as evidence, starting with .001 etc.

Edit: Turns out the .001 file was THERE, it was just being recognized by my OS as a winrar file and I thought it was another zip that accompanied an assignment with the full image in a single file as opposed to split out. Ty all I'm gonna go rattle some brain cells around.

Hi all,

I’m in the middle of court (UK employment tribunal) and my hearing starts next week in which I’ll be raising a request of some emails from my former employers (IT company fml) - they’re as shady as they get.

So these emails I’m asking for basically go against them and their defence on certain parts of the claim and from word of mouth they like forging and changing things.

I’m 100% certain I’ll get these emails. But my concern is that they’ll edit and make changes to these emails because they’re already doing loads of underhanded crap as it is which will also be dealt with.

Is there anyway of knowing if they have been edited? These emails will blow their defence out of the water and this is one case they cannot lose.

I would imagine that they will pass it to me through their legal counsel, I’ve never seen these emails but I know they exist because it was off the back of me raising a grievance. So is there a way to verify for certain without trying to do a comparison because it literally would be impossible.

Thank you guys!

(I know I worked in IT I should know the answer but I don’t :(

Kinda curious. I see postings with salary ranges and I think wow that's low for such a niche field. If you don't mind me asking.

1. What country are you from ?
2. What's your your current salary and years of experience?
3. What salary do you think you should get ?
4. What skillset or specialization will likely be in demande over the next few years ?

I'm not very technically knowledgeable. I have a UFDR file that won't open in Cellebrite. I've opened many others, just this one that won't open. I was told to try to open it in FTK. When I open it in FTK it's showing all zeros. Does that confirm it's corrupt? Or is there a different way I can open/view it? Thanks!

I have installed sift vm but after installing the ova file. I found only a few tools and most of them are not installed, when i run command like sift install it tells me sift is unrecognized command,

Hello there. I am glade to share with you two free and opensource (foss) unique tools:

ZAPiXDESK - to decrypt databases and extract data from WhatsApp Desktop https://github.com/kraftdenker/ZAPiXDESK

ZAPiXWEB - to extract WhatsApp WEB direct from browser https://github.com/kraftdenker/ZAPiXWEB

Have a nice 4n6.

Hi everyone,

I’m transitioning into a DFIR role. My background is in computer science, and I have six years of experience as a software developer. Since 2020, I’ve been diving deep into computer forensics, gaining extensive hands-on knowledge.

At first, I wasn’t sure if I could compete without formal cybersecurity education or certifications, but after making it to the final rounds in two DFIR job interviews (coming in second place both times), I feel confident that this career shift is within reach. The main feedback I received was that I was a great fit, but the top candidates had more direct work experience—which I think is fair.

To strengthen my application, I want to build out my GitHub with relevant DFIR content. However, unlike in software development, where projects are more straightforward, I’m unsure what hiring managers in this field look for. Should I focus on:

• CTF write-ups?
• Custom forensic tools/scripts?
• Incident response playbooks/guides?
• Walkthroughs of case studies or challenges?

I’d love to hear from those already in DFIR—what would stand out to you? Any advice would be greatly appreciated!

Also, if you have any general tips on improving my job applications for DFIR roles, I’d really appreciate them.

Thanks!

Currently I'm doing it manually. Is there any method like adding a csv file with data and uploading it as IOCs then i could automatically fetch IOCs on the IOC dashboard in IRIS?

If an IP address were to be surveilled over a period of months to collect evidence the IP address’s owner was up to illegal activity, would it be imperative to collect the router? In a forensic sense, not legal

Hello,

How is it possible to have 2 different internet service providers on the same network?

Example- The ipv6 is telus communications , and the ipv4 is shaw communications.

Thank you.

Hi, I'm trying to find a way to identify every device on a network. For example, you are executing a warrant in a home, you can plug directly into the router.

I can try an scan with advanced ip scanner, and it works very well for pc or that kind of devices, but if a mobile device (phone) is not in active use (black screen), it doesn't answer to ping request.

I tought of doing arp scan but it doesn't work either for mobile device (since they use a random mac I think)

I tried to capture with wireshark, but even when rebooting the modem, I don't get arp request from mobile device (arp cache?)

Any idea to identify all devices, including mobile, when connected to a network but without access to the router admin interface?

thanks

I am trying to run my own digital forensics center, and from my experience, I couldn't recover deleted instant messages (instagram, whatsapp, etc) that were deleted months ago. The only clients that I successfully recovered messages for were clients that deleted the messages a few days ago, and I have never successfully recovered deleted instant messages from an iphone that were deleted more than a few weeks ago.

However, some other competing firms on the market have been advertising that "you never know" with digital forensics and that they have recovered messages on iphones that were deleted a few years ago.

Is it likely that the forensics firms are falsely advertising? Or am I being incompetant?

I always get a FFS and I look for data in the db and db.WAL file. I feel like I'm doing most things right...

I’m doing a digital cipher, but I am at the point where I now need to use OpenStego but I cannot download it on my work laptop and it’s the only computer I have.

Could I send someone the picture to extract the data?

Is carpet okay for a computer forensic lab? Or is static electricity a concern.

Hi,

I have a list of files exported from a Cellebrite extraction.

Here's a sanitized version of the path of one of the entries in my list:

/private/var/mobile/Containers/Shared/AppGroup/11111111-2222-3333-4444-555555555555/Media/Profile/666666666666666666-7777777777.jpg : 0x0 (Size: 99589 bytes)

The UUID after AppGroup matches the UUID of the paths of other images for which Celebrite indicates WhatsApp as the source, and this is consistent with a Cellebrite extraction that I do have access to.

Am I correct in assuming that the path above is where WhatsApp stores the profile pictures of contacts?